With the evolution of Wireless Medical Sensor Networks (WMSNs), real-time remote patient monitoring has become more feasible than ever before. Different sensors can be used e.g. at home to monitor patient’s vital signs such as pulse, respiration and blood pressure. However, given the distributed nature of WMSNs for remote patient monitoring, there is a greater challenge in ensuring data security, integrity, confidentiality and access control. This is because the transmission of personal and medical information is done over insecure communication channels i.e. the Internet. At the same time, patient’s physiological data are highly sensitive and remote patient monitoring systems are extremely vulnerable to many attacks. Since there is great need to access the real-time data inside WMSN nodes, proper authentication of entities (e.g. health personnel) must be ensured before allowing them access. To this end, this paper proposes a pairing based authentication and key establishment scheme for remote patient monitoring systems. The scheme is two-factor i.e. combines smartcard and password, and achieves various desirable properties such as mutual authentication, strong access control, patient identity privacy, patient un-traceability, replay attack resistance and forward secrecy.