# Health IoT Threats: Survey of Risks and Vulnerabilities
## 2 Background of the Research  
Security and privacy are among the most important aspects of any system, and in healthcare, their importance cannot be overemphasized [30]. Clinical information, and in particular patient healthcare data, is considered sensitive information and mostly private as it may contain patient private information such as medical background, health conditions, and emergency contact details. This information becomes even more sensitive when it contains confidential medical data on sexual and physiological health or disease and drug misuse that patients generally refuse to share with anyone but their doctors. Moreover, over time patients' medical records become a rich repository of all types of information, including medical history, dietary and genetic data, and even family medical history. Despite the significant IoT potential, security and privacy issues have limited the widespread deployment of IoT technologies in the healthcare domain [36]. Currently, healthcare information and data are exposed to more types of security and privacy breaches compared to the last 20 years, as reported by the Health Insurance Portability and Accountability Act (HIPAA) [37]. HIPAA is a US federal law that provides standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge [38]. The main issue of security and privacy breaches in healthcare is the lack of proper synchronization of security and privacy issues and technologies in the particular domain of healthcare [39]. This issue becomes further accentuated considering the new technologies such as mobile devices, cloud services, and remote applications being deployed in the healthcare system [40; 41]. While these technologies have improved data accessibility in healthcare, they have also increased the risk of security and privacy breaches of health information. The increasing dependence on technologies may result in increasing the vulnerability of population health data and makes citizens' healthcare information susceptible to different types of threats and misuse that may, in turn, have devastating impacts on both patients and healthcare organizations [42; 43]. The lack of consideration for security and privacy in healthcare and IoT technologies is also a barrier to fully exploiting the potential of these technologies to address current challenges in healthcare. Therefore, it is crucial to clearly define and understand the concepts of security and privacy in healthcare. For this study, the following definitions were adopted from [44]:  
Security: Protective measures that enable a healthcare organization to perform its critical functions despite risks posed by threats to its use of information systems. Privacy: The restriction of access to healthcare information in accordance with laws and policies. The significance of maintaining security and privacy in healthcare cannot be overstated, as evidence shows that security breaches in medical data can result in financial losses, medical identity theft, and discrimination [45; 46]. Even the inappropriate disclosure of healthcare data can disrupt patients' privacy and expose them to further problems [47]. In some cases, people's health credentials can be stolen during medical treatments, leading to economic losses for healthcare providers and potential health consequences for patients due to the manipulation of their medical records [48]. Statistics show that breaches in healthcare records create financial concerns, psychological harm, medical identification fraud, and potential social stigma or prejudice against people with a specific condition [49]. Victims' health credentials are hijacked in some situations for medical treatment, which causes financial losses for healthcare institutions and could also have health effects for individuals owing to the alteration of their medical files [49]. Even inadvertently leaking healthcare data can affect patients' privacy [50; 51] and expose them to additional issues like those described above.