Portable devices and sensors-based Internet of Medical Things (IoMT) healthcare can remotely detect patients' physiological data and provide first-class healthcare services. However, the high privacy and sensitivity of medical data make IoMT healthcare systems vulnerable to various attacks. While numerous authentication protocols have been introduced in recent years to guarantee authorized access, these schemes continue to face challenges such as privacy disclosure, untraceability of malicious behavior, insufficient cross-hospital access, and concerns related to single points of failure and trust. To address these issues, we propose a Double Anonymity Strategy to hide identities between doctors and the patients while allowing the authorized party to track their malicious behavior, enhance users' privacy and track malicious users. Our approach leverages the advantages of blockchain, such as decentralization, and replaces trusted third parties with smart contracts for efficient and automatic identity authentication. Additionally, we introduce a cross-hospital authentication scheme that incorporates three-factor secrecy, ensuring that even if any two of the three factors (device, biometric information and password) are compromised, the security of the proposed scheme will not be affected. The security of our scheme is formally proven under the random oracle model, which formally measures that the probability of an adversary breaking the scheme is negligible. We also provide informal security analysis showing that our scheme prevents privacy breaches, achieves decentralization, and addresses existing various attacks. Furthermore, through simulation of the proposed scheme and comparison with related works, we demonstrate that our scheme achieves 23% to 87% reduction in computational cost while maintaining higher security properties.