Catalonia is preparing to remove passwords from its public health portal, La Meva Salut. The Department of Health has confirmed that by early 2027, users will only be able to log in with idCAT Mòbil, a digital ID system. The change affects millions of residents and is intended to close security gaps and meet EU data protection rules. The shift follows regulatory pressure and recent security incidents, as reported by ARA and in official AOC consortium statements.
Until now, users could choose between a personal password and idCAT Mòbil to access their health records. After a series of credential thefts in 2024, authorities tightened security and added two-factor authentication. Passwords are still being phased out: starting in January 2025, new passwords were issued only until the end of that year. The phase-out now accelerates. The last day to create a new password is September 15, 2026. By January 2027, password access will be fully disabled for everyone, information from several official sources.
idCAT Mòbil is a digital authentication tool that sends one-time codes to registered phones. It is not an app and requires no download. Users register online by linking their ID to a mobile number. Each login triggers an SMS with a unique code, which users must enter to access the portal. The process is free and designed to be simple, but it requires a mobile phone and some digital skills. The AOC describes idCAT Mòbil as a simpler and more secure way to log in, and the system is being adopted across Catalan digital services.
Another major change is the expansion of delegated access. Soon, adults will be able to authorize trusted relatives or caregivers to manage their health profiles from their own accounts. Previously, this feature was limited to parents and legal guardians of minors or dependents. The update is intended to help elderly users and those who struggle with digital tools. It follows complaints, including one from the Síndica de Greuges, about the difficulties families faced when stricter authentication was introduced. Local media, including El Periódico, have reported more complaints from older citizens and people with limited digital skills, prompting authorities to speed up support features.
The Department of Health has set a gradual timeline for the changes, with full implementation expected by early 2027. Until then, both passwords and idCAT Mòbil will work, but the window for requesting new passwords closes in January. The shift responds to security incidents and regulatory demands from Brussels. La Vanguardia reports that existing passwords will remain valid until they expire, but after September 2026, users will no longer be able to create or recover passwords.
To register for idCAT Mòbil, users need their ID and a mobile number, with an email address also required. The system verifies the phone by SMS before activating the account. Once registered, users log in to La Meva Salut by entering their ID and phone number, then confirming the one-time code sent by SMS. No app installation is needed, and the process is designed to be straightforward for people familiar with basic digital tools.
The practical impact is clear: Catalans who use La Meva Salut to manage appointments and prescriptions or check test results will need to adapt. Those without mobile phones or digital skills may face difficulties, although delegated access is intended to help vulnerable groups. The situation reflects broader challenges in Spain’s digital change, where technical upgrades can run up against an aging population and uneven access to technology. Other areas show a similar gap between policy and practical access, including the environmental oversight issues reported earlier.
Catalonia’s decision to retire passwords from La Meva Salut responds to security failures and regulatory demands, while also highlighting the digital divide. By expanding delegated access, authorities recognize that not everyone can manage digital bureaucracy alone. The change raises the question of whether the system will become both secure and accessible, or whether families and caregivers will shoulder more of the burden. For now, users will need to switch to idCAT Mòbil or risk losing access to their health records.
