# Data Protection and Privacy of the Internet of Healthcare Things (IoHTs)
## 1 Introduction  
The IoT is an emerging technology that facilitates consumers by exchanging information with devices connected to the Internet. The International Telecommunication Union (ITU) [1] defines IoT as the network of sensor devices interacting with the environment. The spectrum of IoT has been broadened and encloses many applications that are used in different scenarios like security, remote monitoring, electrical appliances control, military use, and other electronic equipment. One primary use case of IoT is in the healthcare sector, i.e., the Internet of Healthcare Things (IoHT), designed to monitor, store, or transmit healthcare information. In simple words, IoHT is a sub-class of IoT specifically dealing with healthcare that includes devices, services, and software [2]. The IoHT describes uniquely identifiable devices connected to the Internet, communicating with each other, used in the medical area. IoHT devices help to monitor individuals' medical conditions by generating clinical data by forwarding it to a remote server or service with the help of wireless network infrastructure [3]. Like any other Internet-based device, IoHT devices have a unique identifier such as an IP address which enables them to connect with the network and to forward/receive data to/from intended devices [4]. The central server manages this collected information and responds accordingly to diagnose patients'diseases. A high-level general working flow diagram of an IoHT implementation is presented in Figure 1. The idea is to provide reliable, efficient, and cost-effective healthcare services by facilitating physicians and medical staff by remotely monitoring their patients. IoHT implementations also enable individuals to manage their health data easily and assist them in how to use wearable health monitors [5; 6]. Data privacy is considered to be a fundamental requirement for consumer acceptance, which can be ensured through the data flow representation, authentication, and authorization of the performed activities such as data collection, retention, processing, and transmission. Data privacy risks are directly related to unauthorized collection, usage, access, storage, and sharing activities. These activities might be the reason for personal data leakage and compromising the user's privacy, especially concerning healthcare data, as it has different priorities and is highly valuable and sensitive. In this regard, appropriate protection and security measures are required [7; 8; 9; 10]. Moreover, accessibility and availability of personal healthcare information on the Internet also cause privacy problems. In June 2015, a censorious privacy violation attack was launched when malware exploited vulnerabilities in blood gas analyzer devices to gain access to hospital networks and leaked private data [11]. Despite this, the privacy framework for IoHT systems and services is expected to be transparent to patients, making available updated information to ensure the protection of patients' data [6]. The healthcare systems collect most of the data from the sensing devices and forward it via intermediate devices to the management layer. During this process, several protocols and encoding schemes are used to communicate data reliably. It is easier to find vulnerabilities in different components of the healthcare system by using search engines like Shodan, which assists attackers in searching the connected vulnerable devices on the Internet [12]. Similarly, a worksheet containing millions of records with user healthcare information can be exchanged in a fraction of a second, seamlessly, and without leaving any consistent trace [10]. Some IoT-related data privacy and protection policies are used to protect data and users' privacy. However, these legal frameworks have not produced the intended results and the actual level of healthcare data privacy protection is insufficient for the issues mentioned earlier [9].