Robust security schemes are crucial for Internet of Medical Things (IoMT)-based healthcare services to prevent security breaches caused by sharing sensitive data across multiple fields. Given the resource constraints of IoMT devices, developing lightweight and efficient security protocols is essential. Masud et al. proposed a protocol for securing sensitive data shared across the insecure wireless medium in IoMT networks. However, the approach suffers from vulnerabilities like offline password-guessing and privileged insider attacks, risking patients’ lives and privacy. Hence, this paper proposes P-MASFEP: security-enhanced PUF (Physically Unclonable Function)-based Mutual Authentication and Session key establishment using Fuzzy Extractor and PKI (Public Key Infrastructure). By leveraging a fuzzy extractor with biometrics, P-MASFEP mitigates offline password-guessing attacks, while mutual authentication and session key establishment through PKI safeguard against privileged insider threats. The paper discusses a detailed informal security analysis followed by formal security verification using the Scyther tool to demonstrate the robustness and effectiveness of the proposed P-MASFEP scheme. Comparative quantitative and qualitative analysis indicates an increase in overheads compared to the existing schemes, traded for enhanced protection from threats.