Key challenges of healthcare IoT governance

Smart healthcare uses IoT devices and cloud analytics to improve diagnosis and workflow, yet these tools heighten cyber risks, widen interoperability gaps, complicating compliance. Conventional IT governance assumes stable systems, overlooking device control, latency, and user adoption, while most IoT frameworks focus solely on security, ignoring clinical realities. This study uses a sequential explanatory mixed-methods strategy: a systematic literature review of 76 papers and interviews with seven experts from Turkiye. Analysis of 13 key IoT challenges, along with current healthcare reference architectures and governance frameworks, reveals three critical gaps: real-time performance assurance, fragmented device-lifecycle control, and limited user engagement. In response, this study introduces Govern-IoT-Health, a governance construct melding the Human-Organization-Technology (HOT-fit) cube with a central Governance-Risk-Compliance (GRC) spine and an explicit Plan-Do-Check/Act (PDC) loop. Its three orthogonal faces align people, structure, and infrastructure, while the GRC core embeds board-level policy, real-time telemetry, and automated compliance checks. Twenty-eight defined mechanisms populate the PLAN, DO, and CHECK & ACT stages. Building on established standards including ISO 27001, ISO/IEC 30141, NIST IR 8259A, HL7 FHIR, ETSI EN 303 645, HIPAA, and GDPR, the framework adds SBOM controls and continuous monitoring atop a curated catalogue of reference architectures (classical three-layer, edge-oriented, multi-layer/service-oriented, security-focused, and standards-aligned). Govern-IoT-Health offers a practical, standards-aligned route to secure IoT deployment.