A Critical Evaluation of IoMT Security Frameworks in Resource-Constrained Healthcare Systems

Winfred Arinaitwe; Kareyo  Margaret; Olusegun Ganiyu

doi:10.51903/jtie.v5i2.528

Authors

Winfred Arinaitwe Department of Information Technology, Kampala International University, Uganda https://orcid.org/0000-0002-8554-7237
Kareyo Margaret Department of Information Technology, Kampala International University, Uganda
Olusegun Ganiyu Department of Computer Science, Kampala International University, Uganda https://orcid.org/0000-0003-4182-3890

DOI:

https://doi.org/10.51903/jtie.v5i2.528

Keywords:

Cybersecurity Frameworks, Healthcare Systems, Information Sharing, Internet of Medical Things, IoMT Security

Abstract

The increasing adoption of Internet of Medical Things (IoMT) technologies within healthcare systems has significantly improved real-time patient monitoring, clinical decision-making, and health information exchange. However, the integration of interconnected medical devices has simultaneously expanded the cybersecurity threat landscape, particularly within resource-constrained healthcare environments characterized by limited technical capacity, inadequate governance mechanisms, and insufficient cybersecurity expertise. This study critically evaluated existing cybersecurity frameworks for Information Sharing-Enabled IoMT systems, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework, COBIT, Critical Information Infrastructure Protection (CIIP), and the IoT Security Foundation (IoTSF) Security Compliance Framework. The study employed a mixed-method exploratory research design combining systematic literature review, comparative framework analysis, and descriptive quantitative assessment conducted at St. Francis Hospital Nsambya and Uganda Martyrs Hospital Lubaga. Quantitative findings were analyzed using descriptive statistics, while qualitative findings were synthesized thematically. The findings revealed that existing frameworks provide fragmented security solutions that inadequately integrate technical security controls, governance mechanisms, healthcare operational requirements, and socio-behavioral determinants necessary for secure IoMT implementation in low-resource healthcare contexts. Based on the identified gaps, the study proposes an integrated healthcare-oriented IoMT cybersecurity framework that combines governance, technical safeguards, compliance mechanisms, and socio-behavioral dimensions to strengthen secure information sharing and cybersecurity resilience within resource-constrained healthcare institutions. The study concludes that context-specific and integrated cybersecurity frameworks are essential for enhancing secure information sharing and sustainable IoMT adoption in developing healthcare systems.

References

Adeleye, A., Adewuyi, A. A. O., Enyiorji, P. U., Ajayi, O. O., Tsambatare, T. E., Oloke, K., & Abijo, I. (2024). The Convergence of Cybersecurity, Internet of Things (IoT), and Data Analytics: Safeguarding Smart Ecosystems. World Journal of Advanced Research and Reviews, 23(1), 379–394. https://doi.org/10.30574/wjarr.2024.23.1.1993

Aferudin, F., & Ramli, K. (2022). The Development of Cybersecurity Information Sharing Framework for National Critical Information Infrastructure in Indonesia. Budapest International Research and Critics Institute (BIRCI-Journal), 5(3), 21379–21389. https://doi.org/10.33258/birci.v5i3.6297

Africa Cyber Security Report. (2020). Local Perspective on Data Protection and Privacy Laws: Insights from African SMEs. Cyber ERM. https://www.cybererm.com/insights/africa-cyber-security-report-2020

Ahimbisibwe, B., & Nabende, P. (2022). A Conceptual Framework for Assessing Information Security Management Practices in Selected Universities in Uganda. Journal of Digital Science, 4(1), 21–29. https://doi.org/10.33847/2686-8296.4.1_2

Ahimbisibwe, B. K., & Nabende, P. (2023). The Institutionalisation of Information Security Management Practices in Selected Organisations in Uganda. International Journal of Advanced Research, 6(1), 48–63. https://doi.org/10.37284/ijar.6.1.1155

Ahmad, A., Desouza, K. C., Maynard, S. B., Naseer, H., & Baskerville, R. L. (2020). How Integration of Cyber Security Management and Incident Response Enables Organizational Learning. Journal of the Association for Information Science and Technology, 71(8), 939–953. https://doi.org/10.1002/asi.24311

Ahmad, A., Maynard, S. B., Desouza, K. C., Kotsias, J., Whitty, M. T., & Baskerville, R. L. (2021). How Can Organizations Develop Situation Awareness for Incident Response: A Case Study of Management Practice. Computers & Security, 101, 102122. https://doi.org/10.1016/j.cose.2020.102122

Ahmad, I., Shahid, F., Ahmad, I., Islam, J., Haque, K. N., & Harjula, E. (2022). Adaptive Lightweight Security for Performance Efficiency in Critical Healthcare Monitoring. IEEE Access, 10, 121111–121124. https://doi.org/10.1109/access.2022.3222343

Ahmed, S. F., Alam, M. S. B., Afrin, S., Rafa, S. J., Rafa, N., & Gandomi, A. H. (2024). Insights into Internet of Medical Things (IoMT): Data Fusion, Security Issues and Potential Solutions. Information Fusion, 102, 102060. https://doi.org/10.1016/j.inffus.2023.102060

Ahmed, S. K. (2024). The Pillars of Trustworthiness in Qualitative Research. Journal of Medicine, Surgery, and Public Health, 2, 100051. https://doi.org/10.1016/j.glmedi.2024.100051

Ahmid, M., & Kazar, O. (2023). A Comprehensive Review of the Internet of Things Security. Journal of Applied Security Research, 18(3), 289–305. https://doi.org/10.1080/19361610.2021.1962677

Ainslie, S., Thompson, D., Maynard, S., & Ahmad, A. (2023). Cyber-Threat Intelligence for Security Decision-Making: A Review and Research Agenda for Practice. Computers & Security, 132, 103352. https://doi.org/10.1016/j.cose.2023.103352

Ajzen, I. (1991). The Theory of Planned Behavior. Organizational Behavior and Human Decision Processes, 50(2), 179–211. https://doi.org/10.1016/0749-5978(91)90020-t

Ajzen, I. (2020). The Theory of Planned Behavior: Frequently Asked Questions. Human Behavior and Emerging Technologies, 2(4), 314–324. https://doi.org/10.1002/hbe2.211

Akbar, S., Coiera, E., & Magrabi, F. (2020). Safety Concerns with Consumer-Facing Mobile Health Applications and Their Consequences: A Scoping Review. Journal of the American Medical Informatics Association, 27(2), 330–340. https://doi.org/10.1093/jamia/ocz175

Akello, M., Coutinho, S., N-Mboowa, M. G., Bukirwa, V. D., Natukunda, A., Lubyayi, L., Nabakooza, G., Cose, S., & Elliott, A. M. (2020). Continuous Research Monitoring Improves the Quality of Research Conduct and Compliance Among Research Trainees: Internal Evaluation of a Monitoring Programme. AAS Open Research, 3, 57. https://doi.org/10.12688/aasopenres.13117.1

Al-Dosari, K., & Fetais, N. (2023). Risk-Management Framework and Information-Security Systems for Small and Medium Enterprises (SMEs): A Meta-Analysis Approach. Electronics, 12(17), 3629. https://doi.org/10.3390/electronics12173629

Al-Hawamleh, A. (2024). Cyber Resilience Framework: Strengthening Defenses and Enhancing Continuity in Business Security. International Journal of Computing and Digital Systems, 15(1), 1315–1331. https://doi.org/10.12785/ijcds/150193

Al Harbi, S., Aljohani, B., Elmasry, L., Baldovino, F. L., Raviz, K. B., Altowairqi, L., & Alshlowi, S. (2024). Streamlining Patient Flow and Enhancing Operational Efficiency Through Case Management Implementation. BMJ Open Quality, 13(1), e002484. https://doi.org/10.1136/bmjoq-2023-002484

Alsubaei, F., Abuhussein, A., & Shiva, S. (2022). Security and Privacy in the Internet of Medical Things: Taxonomy and Risk Assessment. IEEE Internet of Things Journal, 9(3), 1762–1779. https://doi.org/10.1109/jiot.2021.3094052

Annamalai, P., Sikamani, K. T., Manjula, V. S., Kannan, R. J., Murugan, S., & Ankamma, K. (2024). Detecting Leaks and Faults in Underground Water Networks. Journal of Electrical Systems, 20(4), 692–702. https://doi.org/10.52783/jes.2090

Baker, T., Asim, M., & Tawfik, H. (2024). A Systematic Review of IoMT Security Challenges and Mitigation Strategies. Journal of Medical Systems, 48(2), 13. https://doi.org/10.1007/s10916-024-02035-2

Bhushan, B., Kumar, A., Agarwal, A. K., Kumar, A., Bhattacharya, P., & Kumar, A. (2023). Towards a Secure and Sustainable Internet of Medical Things (IoMT): Requirements, Design Challenges, Security Techniques, and Future Trends. Sustainability, 15(7), 6177. https://doi.org/10.3390/su15076177

Coventry, L., & Branley, D. (2023). Cybersecurity in Healthcare: A Narrative Review of Trends, Threats, and Responses. Health Informatics Journal, 29(1), 1–15. https://doi.org/10.1177/14604582231151833

Deb, S., Lupu, E., Drakakis, E. M., Bharath, A. A., Leung, Z. K., Ma, G. R., & Chattopadhyay, A. (2025). Securing the Internet of Medical Things (IoMT): Real-World Attack Taxonomy and Practical Security Measures. arXiv. https://arxiv.org/abs/2507.19609

Dzamesi, L., & Elsayed, N. (2025). A Review on the Security Vulnerabilities of the IoMT Against Malware Attacks and DDoS. arXiv. https://arxiv.org/abs/2501.07703

Fikri, H., & Muchlis, M. (2026). Decision-Support AI Health Dashboard Using Synthetic Data for Daily Health Monitoring. Jurnal Ilmiah Sistem Informasi, 5(2), 429–441. https://doi.org/10.51903/mp66jy72

Geoffrey Getare Nyauma, & Manjula, V. S. (2023). Revolutionizing Legal and Business Processes of the Digital Age Using Blockchain Technology. Journal of Applied Science, Information and Computing (JASIC), 4(1), 1–11. https://doi.org/10.59568/jasic-2023-4-1-01

Ghubaish, A., Salman, T., Zolanvari, M., Unal, D., Al-Ali, A., & Jain, R. (2023). Recent Advances in the Internet of Medical Things (IoMT) Systems Security. IEEE Internet of Things Journal, 10(3), 2318–2336. https://doi.org/10.1109/jiot.2022.3211516

Hireche, R., Mansouri, H., & Pathan, A.-S. K. (2022). Security and Privacy Management in Internet of Medical Things (IoMT): A Synthesis. Journal of Cybersecurity and Privacy, 2(3), 640–661. https://doi.org/10.3390/jcp2030033

Islam, S. M. R., Kwak, D., Kabir, M. H., Hossain, M., & Kwak, K. S. (2015). The Internet of Things for Health Care: A Comprehensive Survey. IEEE Access, 3, 678–708. https://doi.org/10.1109/access.2015.2437951

Jaidi, F., Ben Ali, A., & Hamdi, M. (2025). An Internet of Medical Things Cyber Security Assessment Model (IoMT-CySAM). Healthcare Analytics, 8, 100245. https://doi.org/10.1016/j.health.2025.100245

Khatiwada, P., & Yang, B. (2022). An Overview on Security and Privacy of Data in IoMT Devices: Performance Metrics, Merits, Demerits, and Challenges. Studies in Health Technology and Informatics, 299, 126–136. https://doi.org/10.3233/shti220970

Kumar, R., & Tripathi, R. (2021). Towards Design and Implementation of Security and Privacy Framework for Internet of Medical Things (IoMT) by Leveraging Blockchain and IPFS Technology. The Journal of Supercomputing, 77(8), 7916–7955. https://doi.org/10.1007/s11227-020-03570-x

Sadhu, P. K., Yanambaka, V. P., Abdelgawad, A., & Yelamarthi, K. (2022). Prospect of Internet of Medical Things: A Review on Security Requirements and Solutions. Sensors, 22(15), 5517. https://doi.org/10.3390/s22155517

Sharmila, E. M. N., Al-Garadi, M. A., & Boustia, N. (2024). IoMT Applications, Benefits, and Future Challenges in Healthcare. Advances in Fuzzy-Based Internet of Medical Things (IoMT), 1–23. https://doi.org/10.1002/9781394285228.ch1

Si-Ahmed, A., Al-Garadi, M. A., & Boustia, N. (2024). Explainable Machine Learning-Based Security and Privacy Protection Framework for Internet of Medical Things Systems. arXiv. https://doi.org/10.48550/arxiv.2403.09752

Udonna, U., Umoren, I., & Ansa, G. (2025). Contextual Framework for Remote Intelligent Monitoring and Detection System for Prediction of Pregnancy Complications. JTIE : Journal of Technology Informatics and Engineering, 4(2), 225–251. https://doi.org/10.51903/jtie.v4i2.244

Vadivel, M., Sridevi, V., Manjula, V. S., Vimal, S. P., Arockiajesuraj, Y., & Murugan, S. (2025). Gait Instability Detection with Temporal Convolutional Networks for Orthopedic Patients. Proceedings of the 4th International Conference on Innovative Mechanisms for Industry Applications (ICIMIA-2025), 112–118. https://doi.org/10.1109/icimia2025.093

World Health Organization. (2025). Cybersecurity and Privacy Maturity Assessment and Strengthening for Digital Health Information Systems. WHO Regional Office for Europe. https://www.who.int/europe/news/item/26-03-2025-who-europe-launches-guide-to-strengthen-cybersecurity-in-digital-health

Yener, R., Hassan, M., & Bashir, M. (2025). Threats and Security Strategies for IoMT Infusion Pumps. arXiv. https://arxiv.org/abs/2509.14604

Zahra, Z., Melyani, M., Yusuf, F., Herawati, M. T., Royanti, S., & Rosihana, A. D. (2025). Implementation of Expert System Applications Using Forward Chaining to Detect Dental Health. JMI: Journal of Management and Informatics, 4(3), 1105–1126. https://doi.org/10.51903/jmi.v4i3.212