Medical Internet of Things (MIoT) is becoming increasingly mainstream as their applications continue to grow. These applications include remote healthcare monitoring, drug storage, alarm systems, and medical wearable devices. Remote patient monitoring, especially using wearable devices, has improved the health and protection of numerous people, while avoiding unnecessary hospital visits. Ideally, healthcare monitoring systems should accurately and timely detect if the patient is entering a critical condition, and alert the concerned doctor accordingly. However, in practice, there are two kinds of alarms raised by such systems, namely, events and anomalies. Events are non-erroneous data that do not conform to the expected values, indicating abnormality in the patient’s condition. On the other hand, anomalies are erroneous data that may result from faulty sensors, electromagnetic interference, malicious attacks, or hardware tampering. These anomalies lead to false alarms which affect the decision making process and may cause danger to the patient’s life. Traditionally, wearable MIoTs, measuring different vitals, frequently communicate with the patient’s phone, or a local processing unit (LPU), in order to analyze and process the collected data. However, the increase in processing capabilities of IoT devices has made on-device event detection possible. This adds an extra layer of defense while avoiding unnecessary communication with LPU. In this paper, a healthcare monitoring system is proposed which compromises of two layers - (1) an online lightweight approach, based on multivariate long-short term memory (LSTM) autoencoder, embedded in each MIoT, that is able to detect data abnormality and alarms the LPU, (2) a correlation technique, at the LPU, that differentiates between anomalies and events, and alerts the patient’s doctor only in case of an event. Since a single sensor reading does not provide enough clinical insight to detect the full length of an event, a feature engineering approach is implemented to extract interpretable statistical, dynamic and physiological features that provide the clinical insight needed. The proposed approach is simulated using Medical Information Mart for Intensive Care (MIMIC) dataset for various vital signs, such as heart rate, systolic and diastolic blood pressure. It is compared with four benchmarks, where the results show the robustness of the model in differentiating between anomalies and events, with event detection sensitivity and specificity above 93%.