Smart wearable devices, as a popular mobile device, have a broad market. Smart wearable medical devices implemented in wearable health monitoring systems can monitor the data pertaining to a patient’s body and let the patient know their own physical condition. In addition, these data can be stored, analyzed, and processed in the cloud to effectively prevent diseases. As an Internet-of-things technology, fog computing can process, store, and control data around devices in real time. However, the distributed attributes of fog nodes make the monitored body data and medical reports at risk of privacy disclosure. In this paper, we propose a fog-driven secure authentication and key exchange scheme for wearable health monitoring systems. Furthermore, we conduct a formal analysis using the Real-Oracle-Random model, Burrows–Abadi–Needham logic, and ProVerif tools and an informal analysis to perform security verification. Finally, a performance comparison with other related schemes shows that the proposed scheme has the best advantages in terms of security, computing overhead, and communication cost.