Internet of Medical Things (IoMT) in Healthcare: Use Cases, Security and Regulation

What is the Internet of Medical Things (IoMT)? IoMT is the network of connected medical devices, wearables, implants and sensors that collect health data and send it to clinicians and software systems, often in real time. It lets care teams monitor patients between visits, catch deterioration earlier and run some care at home instead of in a hospital. Which is quite important, because 76.4% of US adults reported at least one chronic condition in 2023 (CDC, Preventing Chronic Disease) - and the statistics most likely look similar in other parts of the world.

This article covers where IoMT delivers value today, how the systems work, and the security and regulatory work that decides whether a connected device ever reaches patients.

Why Does the Internet of Medical Things Matter for Healthcare Providers?

IoMT matters because chronic disease has outgrown a care model built on occasional appointments. Ninety percent of the $5.3 trillion the US spends on health care each year goes to people with chronic and mental health conditions (CDC). More than half of US adults (51.4%) live with two or more chronic conditions.

The chain is easy to trace. A patient with heart failure or diabetes sees a clinician every few months, so a worsening trend often surfaces only when it becomes an emergency. Emergency admissions are the most expensive way to treat a condition that could have been managed earlier. Continuous data from connected devices closes that gap between visits.

The devices are already in patients' hands. According to Rock Health's 2025 Consumer Adoption Survey of 8,000 US adults, 46% own a wearable, and 59% of owners have discussed their wearable data with a provider. Yet many health systems still haven't turned on Apple HealthKit or Google Health integrations in their patient portals. The bottleneck is no longer adoption. It's getting device data into clinical workflows.

The market reflects this. Grand View Research values the global IoMT market at $230.7 billion in 2024 and projects $658.6 billion by 2030, with North America holding about 35% of the market.

How Does an IoMT System Work, From Sensor to Clinician?

An IoMT system moves data through four layers: the device, a gateway, a cloud or hospital platform, and the clinical systems where people act on it. Each layer has its own failure modes, and most projects underestimate the last two.

1. Device: a sensor or implant captures a signal: glucose, heart rhythm, blood pressure, gait. Firmware handles encryption, pairing and over-the-air updates.

2. Gateway or edge: a smartphone companion app, home hub or bedside unit relays the data. Processing here (edge computing) lets the system raise urgent alerts immediately and send only relevant data upstream, which matters when a dropped connection could delay a critical alert.

3. Platform: a cloud or on-premise backend stores data, normalizes it and runs analytics or AI models.

4. Clinical integration: data reaches the EHR and the care team, ideally through HL7 FHIR APIs, as alerts and trends a nurse or physician can act on.

The fourth layer is where value is won or lost. A remote monitoring program that floods clinicians with readings creates alert fatigue, and staff stop looking. Good IoMT products set patient-specific thresholds, escalate only what needs a human, and present data inside the tools clinicians already use rather than in yet another dashboard.

What Are the Most Valuable IoMT Use Cases in 2026?

The strongest IoMT use cases share one trait: the device data changes a clinical decision that would otherwise come too late. These four have the clearest track record.

Remote Patient Monitoring for Chronic Conditions

Remote patient monitoring (RPM) is the most mature IoMT use case. Continuous glucose monitors such as the Dexcom G7 and Abbott FreeStyle Libre 3 send readings to a phone app and on to the care team, so insulin therapy can be adjusted based on weeks of data instead of a single lab result.

In cardiology, Medtronic's BlueSync-enabled pacemakers send device data through the MyCareLink Heart smartphone app to clinicians, removing the need for a bedside monitor. The prerequisite in both cases is a clinical team with the time and protocols to review incoming data. Without that, RPM becomes a data dump.

Connected Devices Inside Hospitals

Inside hospitals, IoMT is less visible but widespread. Smart infusion pumps use dose error reduction software to block programming mistakes before they reach the patient. RFID and Bluetooth tags track pumps, wheelchairs and monitors, so staff spend less time searching for equipment.

The catch is scale. A large hospital can run thousands of connected devices from dozens of vendors, many on outdated operating systems that can't be patched. That makes hospital IoMT as much a network security problem as a clinical one (see the security section below).

Smart Implants for Post-Surgical Recovery

Smart implants collect recovery data without asking anything of the patient: no charging, no app to open. Zimmer Biomet's Persona IQ knee implant measures range of motion, step count, walking speed and stride length, and sends them to the care team through the mymobility platform. Mayo Clinic uses it to follow patients' recovery remotely and step in when progress stalls.

That value depends on linking implant data to rehab plans and follow-up decisions, which is a software and workflow problem.

AI Detection on Continuous Device Data

The newest use case runs AI models directly on wearable data to detect acute events. Empatica's EpiMonitor, which runs on the EmbracePlus wristband, received FDA 510(k) clearance in June 2025 as an aid to seizure monitoring at home. It detects generalized tonic-clonic seizures and alerts caregivers.

Running AI on device data raises the regulatory bar. An AI model that triggers clinical alerts is regulated as part of the device, needs clinical validation, and must be monitored for performance drift after launch. For a deeper look at the analytics side, see our article on healthcare data management and predictive analytics.

What Are the Biggest IoMT Security Risks?

The biggest IoMT security risk is that every connected device is a potential entry point into the hospital network. In 2024, healthcare reported more cyberthreats than any other US critical infrastructure sector: 444 incidents, including 238 ransomware attacks, according to FBI data reported by the American Hospital Association. The same report notes that hacking incidents reported to HHS affected a record 259 million Americans, about 190 million of them from the Change Healthcare ransomware attack alone.

For IoMT, three risks stand out:

• Device tampering. An attacker who controls an insulin pump or monitor could change its behavior or the data it reports.

• Lateral movement. A poorly secured device, such as a patient monitor on an old operating system, becomes the foothold for reaching EHRs and core systems.

• Unpatchable fleets. Devices often stay in service for 10 years or more, long after their software stops receiving updates.

The defenses are well understood, even if they're hard to apply to legacy fleets. Zero-trust architecture authenticates every device and connection instead of trusting anything inside the network. Network segmentation keeps a compromised device from reaching core systems. For manufacturers, a software bill of materials (SBOM) and a plan for patching vulnerabilities after launch are now regulatory requirements in the US, not nice-to-haves (see the regulation section below).

Why Is IoMT Interoperability Still So Hard?

IoMT interoperability is hard because most devices still use proprietary protocols and data formats, while hospitals need data in their EHR in a standard form. Every new device type can mean another custom integration, another mapping of clinical terms, and another point of failure.

The practical fixes:

• Standardize on HL7 FHIR for anything that touches the EHR, and require vendors to support it during procurement.

• Use an integration layer (middleware or IoT gateway) that converts device formats into one internal data model, so adding a device doesn't mean rewriting downstream systems.

• Normalize clinical terms early. Map readings to standard codes such as LOINC at ingestion, so analytics and alerts don't misread data.

There's also a build-versus-buy decision here. If your product needs data from common consumer and medical devices, a device-data aggregation platform can save months of integration work. Building your own device layer only pays off when the device is your product or your differentiator. Most HealthTech teams should own the clinical workflow and the data model, not the Bluetooth stack.

Which Regulations Apply to IoMT Devices in the US and EU in 2026?

IoMT devices that diagnose, monitor or treat patients are usually regulated as medical devices, and they also fall under health data privacy law. In 2026, the main frameworks look like this:

The FDA change has the most practical impact. Since October 2023, FDA can refuse to accept a premarket submission for a cyber device that lacks the required cybersecurity documentation. That means threat modeling, an SBOM and an update mechanism have to be designed in from the start. Teams that add them late typically rework architecture just before submission, which is the most expensive time to do it.

Even if the HIPAA Security Rule update hasn't been finalized, building to its proposed baseline (encryption in transit and at rest, MFA, asset inventories) is the safer choice. Retrofitting it later costs more than doing it now.

Our HealthTech Director Piotr Zając and Janet Kwiatkowski of MAE Group explain how to make compliance part of the build in "When You Design the Software, You Design the Regulation."

To see how ready your connected device is for that conversation with regulators, run our free SaMD self-assessment, Building It Right the First Time, built with MAE Group.

What Does It Take to Build an IoMT Product That Clinicians Actually Use?

A successful IoMT product is an integration and trust project as much as a hardware one. It needs data that reaches the EHR in a standard form, alerts that respect clinicians' time, security that survives a 10-year device lifecycle, and a regulatory path planned before the first line of code. Get those right, and connected devices deliver what they promise: earlier intervention, fewer avoidable admissions, and more care at home.

Monterail builds HealthTech software, from patient-facing apps to the platforms and integrations behind connected devices, and works with regulatory partners such as MAE Group to build compliance into the product. If you're planning an IoMT product or struggling to get device data into clinical workflows, let's talk about what's worth building first.