Home » Blog » IoT in Healthcare (IoMT): Connected Devices, Use Cases, Compliance and Cost

IoMT has turned the average US hospital bed into a small network of 10 to 15 connected devices. Infusion pumps, patient monitors, smart beds, and badge tags stream data through healthcare app systems every shift. (HIT Consultant, citing Asimily).

Visibility lags behind that growth. In a December 2025 Asimily survey, 43% of hospital CISOs ranked device visibility as their top priority.

Money keeps flowing in regardless. Fortune Business Insights values the global IoMT market at $101.89 billion for 2026. Medicare paid more than $500 million for remote patient monitoring in 2024, according to HHS OIG.

Device count is the easy number to report. Harder questions live in the data layer. Can one glucose reading reach a nurse, a Medicare claim, and an audit log in usable form?

Healthcare app systems that scope devices first and data contracts last end up paying for integration twice. 

 

 

What Is IoMT? How the Internet of Medical Things Works in Healthcare

IoMT, the Internet of Medical Things, is the network of connected medical devices, software, and health IT systems. Wearables, implants, and bedside equipment collect patient data and transmit it through gateways and cloud platforms.

Clinicians then see those readings inside EHRs, dashboards, and decision support tools. 

A device belongs to IoMT when three conditions hold:

• A clinical or health function

The device measures, treats, or diagnoses something clinical, such as glucose, heart rhythm, or infusion rate. RTLS tags qualify at the edge because they locate equipment that care depends on.

• Network connectivity

Bluetooth Low Energy, Wi-Fi, cellular, or wired Ethernet moves data off the device. A standalone thermometer with no radio sits outside the category.

• A downstream decision

Someone or something acts on the output: a nurse, a physician, an algorithm, or a billing system. Data nobody reads adds cost without adding care.

IoMT vs IoT in Healthcare: Where the Line Sits

IoT is the umbrella term for internet-connected objects, such as smart thermostats and fleet trackers. Healthcare IoT, sometimes called IoHT, adds hospital sensors that never touch a patient, like hand hygiene monitors.

IoMT is the regulated core of that group. Failure here can mean a missed arrhythmia or a wrong insulin dose. Regulators respond with FDA premarket review and HIPAA duties wherever covered entities handle data.

Lifecycles differ too. A consumer sensor might last three years. Infusion pumps and CT scanners often run 10 to 15 years, outliving vendor support for their operating systems. That gap explains most of the security trouble covered later.

 

Dimension	General IoT	IoMT
Typical devices	Thermostats, fleet trackers, factory sensors	CGMs, ECG patches, infusion pumps, patient monitors
US regulators	FCC, FTC	FDA (CDRH), HHS OCR, FTC, FCC
Data class	Operational data	ePHI when a covered entity or business associate handles it
Cost of failure	Downtime, lost revenue	Delayed diagnosis, dosing error, patient harm
Service life	3 to 5 years	10 to 15 years for capital equipment

 

IoMT in 2026: Market Size, Adoption and Growth Drivers

Market estimates for IoMT diverge because firms define the category in different ways. Fortune Business Insights puts 2026 revenue at $101.89 billion, growing at a 44.22% CAGR through 2034.

A ResearchAndMarkets report projects close to $300 billion by 2030. The spread matters less than the direction, and every forecast points up.

Five forces explain the demand:

• Chronic disease load

The CDC counts 38.4 million Americans with diabetes. Each is a candidate for continuous glucose monitoring, and many also carry hypertension that connected cuffs can track at home.

• Reimbursement momentum

Medicare RPM spending grew from $15 million in 2019 to over $500 million in 2024. Two new 2026 codes now pay for patients who transmit between 2 and 15 days of readings.

• Capacity pressure

Emergency departments board admitted patients for hours when beds run short. Congress extended the Acute Hospital Care at Home waiver through September 30, 2030, giving health systems a funded way to add virtual beds (AMA).

• Sensor and AI maturity

FDA’s list of AI-enabled devices passed 1,600 entries in September 2026 (FDA). Over-the-counter CGMs reached US pharmacy shelves in 2024.

• Interoperability mandates

CMS-0057-F requires payer FHIR APIs by January 1, 2027. The national TEFCA network carried 464 million documents by the end of 2025 (ASTP/ONC).

 

How Does IoMT Work? The Architecture Behind Connected Medical Devices

IoMT works as a six-layer chain. A sensor captures a reading, and a radio sends it to an edge gateway.

Cloud services store and analyze the data. An application alerts a clinician, and an AI integration layer writes results into the EHR. Each layer carries its own engineering trade-offs.

1. Device Layer

Every IoMT chain starts with a sensor and its firmware. Secure boot and signed firmware images stop tampered code from running. FDA reviewers expect both in cyber device submissions.

Battery budget shapes the rest. A CGM transmitting every five minutes cannot afford heavy encryption handshakes, so engineers choose lightweight protocols.

2. Connectivity Layer

Radio choice follows the care setting. Wearables pair with a phone over Bluetooth Low Energy, which sips power but needs that phone nearby.

Home kits often ship with LTE-M or NB-IoT cellular, so an 80-year-old patient never pairs anything. Bedside equipment runs on hospital Wi-Fi or wired Ethernet. For room-level location, RTLS tags rely on BLE, UWB, or infrared. Private 5G stays at pilot stage on most hospital campuses.

3. Edge Layer

A mobile app, a home hub, or a hospital gateway sits between the device and the cloud. Readings get buffered during network outages and filtered for motion noise.

Inference can happen here as well. An ECG patch that flags arrhythmia on the device transmits an event and keeps raw waveforms local. Bandwidth drops, and so does exposure of sensitive data.

4. Cloud Layer

Ingestion services accept MQTT or HTTPS traffic and write it into a time-series store. A device registry tracks serial number, firmware version, and patient assignment.

Over-the-air update services push patches once FDA-cleared changes are ready. AWS, Microsoft Azure, and Google Cloud all sign HIPAA business associate agreements for eligible services.

5. Application and Analytics Layer

This layer is where clinicians and patients meet the data. Nurse dashboards rank patients by risk, and alert rules decide which readings interrupt someone.

For RPM billing, time logs record minutes of management against each CPT code. Patient apps show trends and prompt missed readings, which protects the billable day count.

6. Integration Layer

HL7 v2 ADT messages supply admission context, and ORU messages carry results. FHIR R4 APIs handle modern exchange. SMART on FHIR lets a monitoring dashboard launch inside Epic or Oracle Health without a second login.

Security runs across all six layers as identity, encryption, and logging. Home deployments fight battery life and patient-owned phones. Hospitals fight scale, with thousands of fixed devices needing segmentation.

Patient-facing layers often ship as cross-platform patient apps for iOS and Android, keeping one codebase across both device ecosystems.

 

Radio	Typical IoMT use	Power draw	Watch-out
Bluetooth Low Energy	Wearables, CGMs, home cuffs	Very low	Depends on a paired phone
LTE-M / NB-IoT	Plug-and-play home kits	Low	Carrier coverage in rural areas
Wi-Fi 6	Bedside monitors, pumps	Medium	Congestion on clinical networks
UWB	RTLS asset and staff tracking	Low	Anchor density raises install cost
Private 5G	Campus pilots, imaging carts	Medium to high	Spectrum and integration effort

 

What Are the Main IoMT Device Classes?

IoMT devices fall into six classes by where they operate. FDA separately sorts every medical device into Class I, II, or III by risk. The two views together decide the pathway, cost, and timeline of any build.

Classes by Care Location

• Wearable and on-body devices

CGMs like Dexcom G7 and Abbott Libre 3 send glucose readings every few minutes. ECG patches such as iRhythm Zio record rhythm continuously for up to two weeks.

• In-home devices

Connected BP cuffs, pulse oximeters, scales, and personal emergency response systems produce spot readings. Their users are often older adults, so setup simplicity decides adherence.

• Implantable devices

Pacemakers, defibrillators and the CardioMEMS heart failure sensor talk to home transmitters. Pulmonary artery pressure trends from CardioMEMS cut heart failure hospitalizations 37% in the CHAMPION trial.

• Bedside hospital devices

Patient monitors, infusion pumps, ventilators, and smart beds generate the densest data streams. Alarms from this group drive most nursing interruptions.

• Imaging and lab systems

CT, MRI, DICOM gateways and analyzers move large files over hospital networks. Their long lifecycles make them frequent security outliers.

• Operational sensors

RTLS tags, cold-chain probes and hand hygiene monitors sit outside FDA device rules. Their data still shapes staffing, capital spending, and infection control.

Classes by FDA Risk

• Class I: Low-risk products, often exempt from premarket review, such as some basic monitoring accessories.
• Class II: Most connected monitors, pumps, and CGMs, cleared through 510(k) against a predicate or through De Novo when no predicate exists.
• Class III: Life-sustaining or implanted devices, such as pacemakers, requiring Premarket Approval with clinical evidence.

IoMT Wearables and the FDA Wellness Line

FDA revised its general wellness guidance on January 6, 2026. Some non-invasive wearables measuring blood pressure or glucose can now stay outside device rules when marketed for wellness.

Marketing language decides regulatory status, so product and legal teams must agree on claims before launch. Dexcom Stelo became the first OTC CGM in March 2024, and FDA cleared it for children aged 2 and up in June 2026 (FDA).

Consumer products in this space often begin as fitness app development with smartwatch integration, then add clinical claims later.

 

Device class	Common examples	Usual FDA class	Primary data
Wearable	CGM, ECG patch	II	Glucose, ECG waveform
In-home	BP cuff, scale, PERS	I or II	Spot vitals
Implantable	Pacemaker, CardioMEMS	III	Device diagnostics, pressure
Bedside	Monitor, infusion pump	II or III	Vitals, alarms, dose logs
Imaging and lab	CT, analyzer	II	Images, results
Operational	RTLS tag, cold-chain probe	Not a device	Location, temperature

 

IoMT Use Cases Across US Healthcare Segments

IoMT looks different in every part of US healthcare. A health system buys it to protect beds and nurses. A payer funds it to lower avoidable admissions. Pharma companies use it to run trials outside research sites.

Acute Care Health Systems: The Smart Hospital

Picture a med-surg floor at 3 a.m., with one nurse covering six patients. Connected monitors stream heart rate, respiratory rate, and oxygen saturation into an early warning model.

When a patient’s score climbs, a remote nurse reviews the trend and calls the bedside team before a rapid response. Kaiser Permanente’s Advance Alert Monitor ran this pattern across 21 hospitals.

Published in NEJM, the program recorded 30-day mortality of 15.8% against 20.4% in comparison patients (Kaiser Permanente Division of Research). Length of stay fell from 7.5 days to 6.7.

Smart infusion pumps add another layer. With pump-EHR interoperability, the order programs the pump, and the pump writes the delivered dose back. Transcription errors between order and pump drop out of the process.

Virtual nursing builds on the same stack. Room cameras and connected devices let one experienced nurse handle admissions, education, and discharge teaching for several units. Stryker launched a SmartHospital Platform at HIMSS26 around this model.

Ambulatory and Chronic Care: Remote Patient Monitoring

Primary care practices and cardiology groups run the largest IoMT programs in the country. Patients with hypertension, diabetes, heart failure, or COPD take home a cellular cuff, CGM, or scale.

Readings arrive on a care team dashboard, and pharmacists or nurses adjust therapy between visits. Ochsner Health’s Digital Medicine program followed 5,057 Medicare patients from 2019 to 2023.

BP control rose from 57.1% to 76.1% among Black patients and from 61.3% to 77.7% among white patients (Ochsner). ED and inpatient use fell with it.

Geisinger saw similar gains with treatment-resistant hypertension. Pairing RPM with a pharmacist brought 74% of patients under control at 12 months (American Heart Association).

Medicare’s 2026 fee schedule widened the model. Code 99445 pays for 2 to 15 days of readings, and 99470 covers the first 10 minutes of management (Nixon Law Group).

Hospital at Home

Acute patients with pneumonia, cellulitis, or heart failure exacerbations can receive inpatient-level care in their own bedrooms. A continuous-monitoring patch, a tablet, and daily clinician visits replace the ward.

Brigham and Women’s randomized trial found direct costs 38% lower for home patients. Their 30-day readmissions came in at 7%, against 23% for hospital patients (Annals of Internal Medicine).

Results depend on setting. A 2025 rural trial across three sites found no significant difference in cost or readmissions (JAMA Network Open). Travel distance and staffing economics change the math outside cities.

Senior Living and Post-Acute Care

Assisted living operators deploy fall detection, bed-exit sensors, and emergency pendants across hundreds of apartments. Ambient sensors learn a resident’s routine and flag changes, such as nighttime bathroom trips rising over a week.

Evidence for connected care in older adults goes back years. The Veterans Health Administration’s home telehealth program cut bed days of care by 25% and admissions by 19% across 17,025 patients (PubMed).

Hospital Operations: Asset Tracking and RTLS

Nurses searching for infusion pumps lose time that never appears on a budget line. RTLS tags on pumps, wheelchairs, and telemetry packs show location on a floor map in seconds.

Piedmont Healthcare reported $2 million in savings across 11 hospitals after system-wide asset tracking. The program also avoided $400,000 in capital purchases over two years (GuardRFID case study).

Location data also answers infection control questions after an exposure. Staff badges show who entered an isolation room and for how long. Hospitals already running fleet and asset tracking software for supply logistics can extend the same location services indoors.

Pharma, Clinical Trials and Cold Chain

Sponsors use wearables to collect trial endpoints at home, cutting site visits for participants. FDA’s guidance on clinical trials with decentralized elements sets expectations for remote data capture.

Biologics and vaccines need unbroken temperature records from manufacturer to patient. Cold-chain sensors log every excursion, and specialty pharmacies running pharmacy delivery app development projects add those logs to proof of delivery.

Payers, Employers and Medtech Manufacturers

Medicare Advantage plans and self-insured employers fund RPM kits for members with costly chronic conditions. CMS’s ACCESS model began its first cohort on July 1, 2026, testing fixed payments for technology-enabled chronic care.

Manufacturers use connectivity for remote diagnostics, predictive maintenance, and postmarket surveillance. Closed-loop insulin systems show where this heads next. Omnipod 5 became the first automated insulin delivery system cleared for both type 1 and type 2 diabetes (Insulet).

 

Segment	Typical IoMT deployment	Metric buyers track
Acute care	Early warning, smart pumps, virtual nursing	Rapid response calls, length of stay
Ambulatory	Cellular cuffs, CGMs, scales	Control rates, billable days
Hospital at home	Continuous patches, tablets	Cost per episode, escalations
Senior living	Fall and bed-exit sensors	Falls, transfers to hospital
Operations	RTLS tags, badges	Search time, rental spend
Pharma	Trial wearables, cold-chain probes	Retention, excursion rate
Payers	Member RPM kits	Admissions per 1,000

 

How Does FHIR Support IoMT Interoperability?

FHIR gives device data a standard, API-ready shape. Each reading becomes an Observation resource linked to a Device and a Patient, with LOINC naming the measurement. That structure replaces a custom interface for every device model.

 

Why Proprietary Protocols Stall Integration

Most bedside devices still speak vendor formats through middleware. A hospital with four pump brands and three monitor brands can end up maintaining seven parsers. Each firmware update risks breaking one of them.

Mapping costs repeat for every new EHR connection. Standards cut that multiplication down to one mapping per device type.

Standards That Carry Device Data

• HL7 v2 remains the internal workhorse for admissions and results inside US hospitals. Interface engines route millions of these messages a day.
• HL7 FHIR R4 is the API standard behind ONC-certified EHRs. R5 arrived in March 2023 as trial use, and R6 entered its normative ballot cycle in 2026 (HL7).
• IEEE 11073 defines device-level semantics. Its SDC family covers point-of-care interoperability, and 11073-10700-2022 sets the base requirements.
• IHE PCD profiles translate 11073 data into HL7 v2 messages for existing interface engines.
• DICOM carries imaging, and TEFCA connects organizations nationally through 11 designated QHINs.

Mapping Device Data to FHIR

Good mappings follow a handful of habits. Every Observation carries a LOINC code plus an IEEE 11073 MDC code, with units normalized to UCUM.

Observation. device points to a Device resource holding serial number and firmware version. That link becomes evidence when a recall hits a firmware release.

For patient assignment, the new DeviceAssociation resource in R6 records who wore which device and when. R4 builds handle it with an extension.

Alerts travel in near real time, while trend data moves in batches to protect EHR performance. Bulk FHIR handles backfill for analytics. Managed services like Azure Health Data Services convert raw device messages into FHIR Observations.

Policy Pressure in 2026

The CMS Health Tech Ecosystem drew pledges from more than 60 companies in July 2025. Payer FHIR APIs become mandatory in January 2027. Device data that already lives in FHIR moves into those networks at little extra cost.

AI models sit naturally on top of normalized data, a pattern teams building AI integration services for US hospitals apply to risk scoring.

 

Standard	Primary job	Strength for IoMT	2026 status
HL7 v2	ADT and result messages	Present in almost every hospital	Legacy, dominant internally
FHIR R4	RESTful APIs	Required for certified EHR APIs	Dominant
FHIR R6	Next release	Adds DeviceAssociation	Normative ballot
IEEE 11073 SDC	Point-of-care device data	Rich device semantics	FDA recognized
DICOM	Imaging	Universal in PACS	Mature

 

IoMT Security: Why Are Connected Medical Devices So Hard to Protect?

Connected medical devices run for a decade or more, often on operating systems their vendors stopped patching years ago. Many cannot go offline without disrupting care.

A patch can also trigger manufacturer revalidation, so known vulnerabilities stay open for months.

Four Reasons the Problem Persists

• Long service life

A pump bought in 2014 may still run Windows 7 Embedded today. Replacing a fleet costs millions, so the device stays.

• Uptime demands 

A ventilator cannot reboot for updates during a patient’s stay. Maintenance windows compete with census.

• Regulatory friction

Manufacturers must validate changes before release, and hospitals cannot patch cleared devices on their own.

• Invisibility to IT tools

Standard endpoint agents cannot run on medical devices. Active network scans can crash older equipment, so many teams avoid scanning altogether.

What the 2025 and 2026 Evidence Shows

Claroty’s Team82 analyzed 2.25 million IoMT devices across 351 organizations. Known exploited vulnerabilities appeared on 9% of devices and inside 99% of organizations (Claroty).

Imaging systems carried the worst exposure. Forescout reported average device risk rising 15% year over year, with infusion pump controllers joining its riskiest list (Forescout).

In January 2025, CISA disclosed a firmware backdoor in the Contec CMS8000 patient monitor. No patch existed, and the agency advised removing affected units (CISA).

Attacks reach patients too. During one ransomware event, stroke code activations at neighboring emergency departments rose from 59 to 102 (JAMA Network Open).

IBM’s 2026 study put the average healthcare breach at $6.64 million, the highest of any industry (HIPAA Journal). ECRI ranks legacy device cybersecurity eighth among 2026 technology hazards.

Controls That Work on Unpatchable Devices

Security teams build compensating layers around devices they cannot change. Passive traffic analysis discovers every device without risking a crash.

Microsegmentation places each device role in its own zone, so a compromised camera cannot reach a pump. Network access control admits only known protocols and destinations.

Vulnerability queues get sorted by KEV status and clinical criticality. Procurement contracts require an MDS2 form listing ports, protocols, and patch plans before purchase. Health systems scoping these programs often bring in AI consulting for US healthcare enterprises to automate triage.

 

Weakness	Real example	Compensating control
Unsupported OS	Pumps on legacy Windows	Segmentation, allow-listing
Hidden firmware behavior	Contec CMS8000 backdoor	Egress filtering, device removal
Internet exposure	Imaging with insecure links	NAC, VPN-only vendor access
Slow patching	Revalidation delays	KEV-based prioritization

 

Is IoMT HIPAA and FDA Compliant? The US Compliance Stack for Connected Devices

HIPAA offers no device certification. Compliance comes from how covered entities and business associates configure, contract, and monitor systems. FDA rules apply separately to manufacturers, with cyber devices facing Section 524B before submission review.

 

HIPAA Security Rule Today

Technical safeguards under 45 CFR 164.312 require access controls, audit controls, integrity protections, and transmission security. Encryption is still “addressable,” meaning organizations can document an alternative.

Business associate agreements bind every vendor touching ePHI, including cloud hosts and RPM platforms. Breaches affecting 500 or more people go to HHS within 60 days.

The Proposed 2025 Update

HHS published a proposed Security Rule overhaul on January 6, 2025. It names medical devices in scope for several new duties:

• Technology asset inventory and network map, updated at least once a year and showing how ePHI moves.
• Mandatory encryption and multi-factor authentication, removing the addressable option.
• 72-hour restoration of critical systems after an incident.
• Vulnerability scans every six months and penetration tests every year.

HHS moved final action to July 2027 (Clark Hill). Building to the proposal now costs less than retrofitting an inventory across 350,000 devices later.

FDA Section 524B and the February 2026 Guidance

Section 524B of the FD&C Act applies to any device with validated software that connects to the internet. Manufacturers must submit three things:

• A postmarket vulnerability plan covering monitoring, coordinated disclosure, and remediation.
• Processes that keep the device secure, including the ability to ship updates and patches.
• A software bill of materials listing commercial, open-source, and off-the-shelf components, usually in SPDX or CycloneDX format.

Since October 1, 2023, FDA has refused submissions missing these elements. The agency issued its current cybersecurity guidance in February 2026, replacing the June 2025 version.

QMSR and Supporting Standards

The Quality Management System Regulation took effect February 2, 2026, incorporating ISO 13485:2016. Software teams pair it with IEC 62304 for lifecycle and ISO 14971 for risk.

Security engineering draws on IEC 81001-5-1 and AAMI SW96. Wireless products also need coexistence testing under ANSI C63.27 (FDA).

Consumer IoMT Outside HIPAA

Wellness apps and wearables sold to consumers often sit outside HIPAA entirely. The FTC Health Breach Notification Rule covers them instead. Washington’s My Health My Data Act adds consent and deletion rights for consumer health data.

Who Owns What

Most compliance disputes come from blurred ownership. Manufacturers produce the SBOM and patches, health systems deploy them, and software vendors document their own components.

Multi-site groups often handle this through enterprise software for multi-site US health systems that tracks every obligation per device.

 

FDA pathway	Used for	FY2026 fee	FY2027 fee
510(k)	Class II with predicate	$26,067	$28,653
De Novo	Novel moderate risk	$173,782	$191,020
PMA	Class III	$579,272	$636,732

Source: FDA MDUFA fees. FY2027 starts October 1, 2026.

 

Obligation	Device maker	Health system	Software vendor
SBOM and patches	Produces	Requests through MDS2, applies	Supplies component SBOM
HIPAA risk analysis	Business associate if handling PHI	Owns as covered entity	Business associate under BAA
Network segmentation	Documents ports	Implements	Isolates cloud tenants

 

 

How Much Does IoMT Software Development Cost in the US?

IoMT software development in the US costs $40,000 to $1.5 million or more. Regulatory class, device count, and EHR integration explain most of the spread. Each tier buys a different level of evidence and scale.

What Each Project Tier Buys

• Wellness wearable app ($40,000 to $90,000)

BLE, HealthKit and Health Connect sync, trend charts, and coaching content. It makes no diagnostic claims, so FDA review stays out of scope.

• HIPAA-grade RPM platform ($120,000 to $300,000)

Device kit onboarding, clinician dashboards, alert rules, CPT time logging, and FHIR push into the EHR. Delivery takes five to eight months.

• Hospital IoMT platform ($300,000 to $900,000+)

Device inventory, RTLS, an HL7 v2 and FHIR engine, SSO, and multi-site rollout. Hardware and tags are billed on top.

• Regulated SaMD ($400,000 to $1.5 million+)

IEC 62304 lifecycle, a 524B cybersecurity package, verification, validation, and a 510(k) submission. Programs run 12 to 24 months.

These ranges reflect Code Brew Labs engagement data and match published tiers on the healthcare app development company in the USA.

What Moves the Number

• Device families: Every new sensor brand needs its own integration and test cycle.
• EHR count: Two EHRs in the healthcare mean two interface builds, two validation rounds, and two support contracts.
• Legacy interfaces: Hospitals on older HL7 v2 engines need translation work before FHIR pays off.
• Deployment model: On-premises hosting adds infrastructure and security staff that cloud platforms absorb.
• Pilot versus enterprise: A single-unit pilot carries a fraction of the load testing, training, and support.

Costs Outside the Build

FDA fees, penetration testing, and annual maintenance sit outside most quotes. Retrofitting security after launch costs far more than designing it in.

Teams comparing options can weigh what a US telemedicine app costs to build against device-heavy programs. Startups validating a concept often begin with MVP development for US digital health startups.

 

Cost component	Range (USD)	Source
Wearable integration per device family	$10,000 to $25,000	Code Brew Labs
Security, audit trails, certifications	$20,000 to $100,000+	Code Brew Labs
EHR interface per EHR	$25,000 to $100,000	Code Brew estimate
524B documentation and penetration test	$50,000 to $150,000	Code Brew estimate
510(k) user fee, FY2027	$28,653	FDA
Annual maintenance	15% to 25% of build	Code Brew Labs

 

What Is the ROI of Connected Medical Devices?

Connected medical devices return value through Medicare payments, avoided readmissions, recovered equipment, and avoided breaches. Payback depends on enrollment, billing compliance, and the care model behind the data.

RPM Revenue Under 2026 Medicare Rates

A fully engaged RPM patient generates about $140 a month under three codes (Prevounce). Five hundred enrolled patients produce roughly $840,000 in gross annual revenue.

Net revenue subtracts device kits, connectivity, clinical staff time, and platform run costs. Compliance erodes the gross figure fast. HHS OIG found 43% of Medicare RPM enrollees missed at least one required service component.

Readmissions and Capacity

The Hospital Readmissions Reduction Program cuts Medicare payments by up to 3% for excess readmissions (CMS). A virtual bed that avoids one readmission protects margin across every Medicare discharge.

Operations and Risk

RTLS savings show up as avoided rentals and capital purchases, as Piedmont’s $2 million shows. Breach avoidance counts too, with each healthcare incident averaging $6.64 million.

What Failed Programs Teach

Not every monitoring program pays off. Kaiser Permanente’s heart failure telemonitoring showed no drop in rehospitalization or mortality (Kaiser Permanente).

BJC HealthCare’s ACO program found no significant readmission change (PMC). The programs that worked put pharmacists or care teams on the receiving end of every alert.

 

Line item (500 patients)	Monthly	Annual
99454 device supply (~$47)	$23,500	$282,000
99457 first 20 minutes (~$52)	$26,000	$312,000
99458 extra 20 minutes (~$41)	$20,500	$246,000
Gross revenue	$70,000	$840,000

Illustrative only. Figures assume full billing compliance.

 

Build or Buy: Choosing IoMT Platforms and Healthcare IoT Vendors

Buying commodity layers and building differentiating ones gets most programs to market fastest. Device security visibility is a mature category worth buying. Patient and clinician experiences decide adoption, so custom builds earn their cost there.

Consolidation is reshaping the vendor list. Axonius acquired Cynerio in July 2025, and Best Buy sold Current Health back to its founder. Buyers comparing partners can review healthcare software vendors in the USA before shortlisting.

 

Layer	Buy options	Build custom when
Device security	Claroty, Armis, Asimily, Forescout	Rarely justified
RPM and home care	Biofourmis, BioIntelliSense	Care model or billing logic is proprietary
RTLS	Zebra, CenTrak, Midmark	Workflows sit on vendor location APIs
FHIR data	AWS HealthLake, Azure, Google Cloud	Data residency demands it
Patient and clinician apps	White-label RPM apps	Brand and EHR embedding decide uptake

 

IoMT Implementation Roadmap: From Pilot to Enterprise Scale

Four phases take an IoMT program from inventory to optimization. Each ends at a gate with measurable exit criteria.

Phase 1: Assessment (Weeks 0 to 8)

The team builds a device inventory and an ePHI flow map mirroring the proposed HIPAA rule. MDS2 forms are collected from every vendor. Candidate use cases are scored on revenue, clinical risk, and integration effort.

Phase 2: Pilot (Months 2 to 6)

One unit or one patient cohort goes live. Success criteria come before launch: alert-to-action time, enrollment retention, and the share of patients reaching billable days.

Phase 3: Scale (Months 6 to 18)

Segmentation and network access control roll out across sites. Every vendor signs a BAA, SBOM monitoring starts, and a second EHR interface usually follows.

Phase 4: Optimization (Ongoing)

Alarm thresholds get retuned per unit. AI models retrain under a Predetermined Change Control Plan, and reimbursement rules get reviewed each quarter.

Five Failure Points to Plan Around

• Alarm fatigue: Between 72% and 99% of clinical alarms are false (AACN Advanced Critical Care). Untuned thresholds train nurses to ignore alerts.
• Legacy devices: Some equipment can never be patched and must be walled off or retired.
• Patient adherence: Readings stop when batteries die, or phones change. Cellular kits reduce that drop-off.
• Broadband gaps: Rural patients may lack reliable coverage, which skews enrollment toward cities.
• Ownership disputes: Biomed and IT teams often disagree about who manages connected devices. A written RACI settles it.

 

What Comes Next for IoMT Beyond 2026?

• Adaptive AI devices 

FDA’s PCCP guidance lets manufacturers pre-authorize model updates. Algorithms can improve after clearance without a new submission each time.

• Cuffless blood pressure 

Apple Watch hypertension notifications gained FDA clearance in September 2025 (Cardiovascular Business). Hilo’s OTC wristband follows in the US.

• FHIR R6 and HTI-5

Device associations become standard, and HTI-5 proposes removing 34 certification criteria.

• Value-based payment

The ACCESS model and the hospital-at-home runway to 2030 reward outcomes over device counts.

• Edge intelligence and federated learning

Models train across hospitals while raw data stays local.

Many of these shifts depend on AI use cases across US medical apps maturing past pilots.

 

IoMT and Healthcare Builds From the Code Brew Labs Portfolio

Code Brew Labs projects cover parts of the IoMT stack. Each one handles a different piece: care coordination, senior engagement, wearable sync, or virtual consultation.

Healthcare AI Cockpit
A regional healthcare coordination platform for managing patient services across care teams. Patient requests and follow-up tasks move through a single AI-assisted workspace.

Coordination now runs 45% faster, and missed follow-ups dropped by 30%. The same workflow logic applies when an IoMT alert needs a named owner and a closed loop.

Ingeni
An AI-powered companion for aged care, designed around voice. Health check-ins happen by speaking, and the app tracks medication schedules alongside them.

Voice removes the setup barrier that keeps many older people away from connected health tools. Senior living and in-home IoMT programs depend on that kind of adherence.

LVL UP
A global, coach-led fitness program app with progress tracking and smartwatch support. Smartwatch data feeds each member’s progress view, so coaches can see activity between sessions.

Members now find a matching coach 60% faster. Wellness-first IoMT apps follow the same sync pattern before they add clinical claims.

Dr. Hakeem
A teleconsultation platform in Saudi Arabia that connects patients with medical services and consultations. More than 50,000 people have downloaded it, and it holds a 5/5 store rating.

Routine care happens remotely, which spares patients a clinic trip. Telehealth is often the front door for IoMT, since remote readings need a clinician on the other end.

Scope, screens, and outcomes for each build are documented in the live portfolio. Virtual visit programs are covered in more depth under telemedicine app development for US providers.

 

Why Choose Code Brew Labs for IoMT Software Development

Code Brew Labs engineers IoMT software for health systems, digital health companies, and medtech teams that need compliance evidence from day one. Threat models, SBOMs, and HIPAA control matrices get written alongside the first sprint, so security reviews start with documents already in hand.

Delivery results carry that approach into production. Healthcare AI Cockpit cut coordination time 45% and missed follow-ups 30% for a regional care network. LVL UP’s smartwatch integration made coach discovery 60% faster.

Compliance work spans HIPAA, FDA Section 524B, QMSR, IEC 62304, ISO 14971, and NIST SP 800-213. Interoperability depth covers HL7 v2, FHIR R4, SMART on FHIR, IEEE 11073, and DICOM.

Our San Diego office team keeps collaboration within US working hours. Health systems can start with an IoMT readiness assessment, a reference architecture review, or a dedicated engineering team. Explore AI healthcare software development for US health systems or contact the team to scope a program.

 

Conclusion: 

That hospital bed with 15 connected devices is a data problem before it is a hardware problem. Programs that succeed settle four documents before any RFP goes out:

• Device inventory and ePHI flow map. It shows what connects and where readings travel.
• Reimbursement model. It names the CPT codes, the cohort, and the expected compliance rate.
• Integration contract. It fixes the FHIR resources, EHR targets, and latency limits.
• Security package request. It asks every vendor for an SBOM, MDS2 form, patch cadence, and BAA terms.

With those in hand, device selection gets simpler. Return on an IoMT program sits in the data layer, and that layer deserves the first budget conversation. Teams without an in-house device practice often partner with an app development company in California for the build.

 

Frequently Asked Questions

What is IoMT?

IoMT is the Internet of Medical Things: connected medical devices, software, and health IT systems that exchange data. Examples include CGMs, ECG patches, infusion pumps, and RTLS tags. Readings move through gateways or cloud platforms into EHRs and clinical dashboards.

How does IoMT differ from IoT in healthcare?

IoT covers any connected object, such as thermostats and factory sensors. IoMT is the subset handling medical data and clinical functions. That subset answers to FDA device rules, HIPAA, and patient safety standards. A failure can harm a patient, so lifecycle and patching demands run higher.

What are the main IoMT device classes?

IoMT devices fall into six location classes: wearable, in-home, implantable, bedside, imaging and lab, and operational tags. FDA also sorts them by risk. Class I carries the lowest risk. Most Class II devices need 510(k) clearance, and Class III implants need PMA approval.

Is IoMT HIPAA compliant? What about FDA?

HIPAA has no device certification. Compliance depends on encryption, access controls, audit logs, and signed BAAs across the system. FDA rules bind manufacturers. Every cyber device must meet Section 524B, including an SBOM, a vulnerability plan, and patch capability.

How much does it cost to implement IoMT in a US hospital?

Hospital IoMT platforms with device inventory, RTLS, and EHR integration cost $300,000 to $900,000 or more. RPM platforms run $120,000 to $300,000. Regulated device software adds FDA fees, such as $28,653 for a FY2027 510(k). Maintenance adds 15% to 25% each year.

What is the ROI of connected medical devices?

Returns come from Medicare RPM payments, fewer readmissions, recovered equipment, and avoided breaches. Brigham’s Home Hospital trial cut direct costs 38%. Piedmont Healthcare reported $2 million in asset-tracking savings. Results depend on the care model, as one Kaiser Permanente heart failure program showed.

How does FHIR support IoMT interoperability?

FHIR turns each device reading into an Observation resource linked to Device and Patient resources. LOINC codes name the measurement, and UCUM fixes the unit. Epic and Oracle Health accept these over RESTful APIs, removing the need for a custom interface per device model.

Does Medicare pay for remote patient monitoring in 2026?

Yes. Device supply pays about $47 a month under 99454 or the new 99445. The first 20 management minutes pay about $52 under 99457. New code 99470 pays about $26 for 10 minutes. Devices must meet the FDA’s medical device definition.