Is a session alone enough for non logged-in users to see some information?
To answer a couple of questions asked:


Extra features to increase safety? You're tying identification/authorization together here; if I know an ID number then I'm authorized to view details associated with it. A malicious actor can just throw guesses at that field to start pulling data they shouldn't have access to. You should increase your authorization criteria (e.g. ask additional details to prove the user is who they say they are) 
and make the form more robust against brute-forcing (e.g. limit requests, use other bot-defeating tools, etc.).
Can a session be stolen? Yes. A PHP session is vulernable to session hijacking if you're using unsecure transport. You should enforce an encrypted session so you can rule that out.