The integration of the healthcare sector with the Internet of Things (IoT) framework has given rise to the Internet of Medical Things (IoMT). IoMT enables the generation, transmission, and examination of medical information through interconnected healthcare IT systems, sensors, and management software. Given the continual progress in IoT technology and the worldwide repercussions of the COVID-19 pandemic, IoMT has gained considerable notice for its capacity in personalized medical data administration, live health surveillance, and distant therapy. However, the sensitive nature of medical data in the IoMT environment has raised concerns regarding security, necessitating robust security protocols for safeguarding medical systems and IoT devices. This paper presents an in-depth exploration and evaluation of an IoMT scheme that incorporates a hybrid security approach, combining password—based authentication with a fuzzy extractor for biometric authentication. A novel system model and attack model are proposed to address the limitations identified in previous work. By conducting formal and informal analyses, we assess the security strengths of the proposed scheme, alongside a comprehensive evaluation of computational costs, thereby highlighting its comparative efficiency in relation to existing schemes.