A systematic mapping review of privacy and security mechanisms in IoT enabled telehealth systems

The proliferation of Internet of Things (IoT) technologies in telehealth has created unprecedented opportunities for remote care delivery while simultaneously introducing complex security and privacy challenges. To systematically capture and analyze the state of research in this domain, we conduct a mapping study following the Taipalus methodology and guided by the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA-S) framework, ensuring transparency and reproducibility. Our work delivers an extensive survey of the literature on IoT-based telehealth systems from 2019 to 2024, with a dedicated focus on security and privacy mechanisms (SPMs), examining their coverage and limitations. We establish a structured mapping between these mechanisms, the specific security and privacy requirements they fulfill, and the categories of attacks they are designed to counter. Finally, we highlight critical research gaps and underexplored dimensions in existing SPM surveys, offering targeted directions for future investigations aimed at strengthening the security posture and trustworthiness of telehealth infrastructures. From an initial pool of 1121 records, 118 studies were systematically selected through well-defined inclusion and exclusion criteria. Thematic analysis revealed a predominant emphasis on authentication, encryption, and anonymization mechanisms. Additionally, authentication and confidentiality were the most frequently addressed security requirements, while anonymity was consistently highlighted as a critical concern for privacy. Most studies focused on replay, man-in-the-middle, and impersonation attacks, while other attack types received comparatively less attention.