I can't speak at all to dental stuff as I've never worked with it. But to your first point, that's sort of expected - they're on a list already, the access has already been configured. They've already gone through all the nonsense.

The point is to send it to any arbitrary doctor they've never spoken to before, which requires offline media.