Internet of Things (IoT) allows the integration of the physical world with network devices for proper privacy and security in a healthcare system. IoT in a healthcare system is vulnerable to spoofing attacks that can easily represent themselves as a legal entity of the network. It is a passive attack and can access the Medium Access Control address of some valid users in the network to continue malicious activities. In this paper, an algorithm is proposed for detecting spoofing attacks in IoT using Received Signal Strength (RSS) and Number of Connected Neighbors (NCN). Firstly, the spoofing attack is detected, located and eliminated through Received Signal Strength (RSS) in an inter-cluster network. However, the RSS is not useful against intra-cluster spoofing attacks and therefore the NCN is introduced to detect, identify and eliminate the intra-cluster spoofing attack. The proposed model is implemented in Network Simulator 2 (NS-2) to compare the performance of the proposed algorithm in the presence and absence of spoofing attacks. The result is that the proposed model increases the detection and prevention of spoofing.