Is it a good practice to isolate login information (username, password) in a separate table? I have a database table called "patient" where I store the patient information. The structure (list of columns) is as follows.

patient table

idPatient (int)
user_name (varchar)
password (varchar)
first_name (varchar)
last_name (varchar)
height (double)
weight (double)


This database is connected to an android app remotly. There is a login process and that is why you can see user_name and password fields. 

However I have an idea about the following table structure, instead of above.

user table

idUser (int)
user_name (varchar)
password (varchar)


patient table

idPatient (int)
user_iduser (int) /*The foriegn key of `user` table*/ 
first_name (varchar)
last_name (varchar)
height (double)
weight (double)


So which type of structure is the best? The only reason I came up with 2nd structure is because to further protect user information by not putting them in same place where it is used for login check.

Please advice.
I would recommend you implement security by encrypting the data you want to keep secure.  Separating the username and password to a different table would not significantly improve their protection.