to clarify I did not say there is an identity theft happening here, but I am saying it can easily happen.
When the NVC sends you the Appointment letter, if has Case number and Invoice ID. Part of the process, you need to print that letter and take for the doctor's appointment and also the interview. This means, you may have to share that with 3rd parties that are not trusted : whoever will get the document by email to print it for you a and who ever works with the physician or the any person that have access to the 3rd party files. With case number and invoice ID you can log online to CEAC and pull out all the files you sent to NVC (tax, affidavit, W2s...)
There is absolutely no need for the doctor to get that invoice ID. The NVC/Embassy either needs to change the process to do not require the appt letter for the doctor's appointment and interview or to send a separate letter that has the case number only . The letter without the invoice ID is enough. This way you don't have to be worried about the middle man during the visa process