While the positive aspects of the IoMT are well enumerated in various studies, implementing the IoMT comes with its own set of challenges, the biggest being the security and privacy of the IoMT. Indeed, the medical data are often considered too sensitive and intrusive. Patients may often not like for their medical or health-related information to be leaked. Hence, the responsibility to protect such data is huge. The issue here, however, is that when we talk about IoMT that includes and welcomes various types of devices and applications in the setting; it would also make it more vulnerable to various types of security- and privacy-related attacks. The inadvertent inclusion of a single malicious device or a device run by a rogue entity could be enough to violate the strict requirement of the privacy of patients' information. Again, compromised data can lead to incorrect diagnoses and, thus, incorrect medications and treatment. This could even be life-threatening for targeted individuals such as national leaders or other important people with high influence or value in a society. Enemies could use the IoMT environment to obtain access to sensitive healthcare information and then cause indirect assassinations. Moreover, healthcare professionals could be wrongly accused of intentionally performing wrong treatments or modifying data and so on. Hence, security and privacy are of paramount importance in the IoMT. Indeed, to enable the wider adoption of IoMT, the security of the objects and networks used must be reinforced. Thus, new lightweight and robust mechanisms must be developed to counter the threats and attacks to which IoMT infrastructures are exposed. In fact, in a study, it was shown that the healthcare security market alone is expected to reach USA $8.7 billion by 2023 [3]. If we checked the most recent trends, we would notice that the attack surface is widening every day for the IoMT environment. On one hand, more and more medical devices are being connected to networks. On the other hand, healthcare establishments are a target favored by cyber-hackers, who are very interested in information about personal health --the most sensitive data of high value. Cybercriminals particularly cover this type of data [4] because of their great value and variety (e.g., credit card number, social security number, mailing address, email address, type of disease, medications, blood group type, things that are harmful to the patient, etc.). In this study, we explored the area of IoMT and mainly focused on security and privacy issues. Some notable works have already been conducted in this domain. We examined and analyzed them and explored the use cases, vulnerabilities and countermeasures, solutions, and recent challenges, and then commented on the future direction of studies in this area. This study is a synthesis of what has been performed in the field of IoMT in the last few years, intended for relatively new researchers in this field, as well as for those who are interested in learning about recent advances and limitations of IoMT security issues and their solutions using new technologies. On the other hand, the comparison between different solutions based on new technologies provides a general overview of the future direction of security and privacy research in the IoMT field. This paper is structured in ten sections. In Section 2, we introduce the context and architecture of IoMT systems. Section 3 defines the important communication protocols in the IoMT. In Section 4, we present IoMT-related technologies. In Section 5, we describe the security requirements to ensure reliability and robustness against various attacks. Then, in Section 6, we discuss different attacks against the IoMT system and classify them according to the presented IoMT architecture. Section 7 defines the categories of devices in the IoMT system and provides a classification of these devices based on their usage. It also presents the potential attacks against these devices. In Section 8, we review the IoMT security model.