As an emerging concept, the metaverse incorporates a range of advanced technologies and offers a great opportunity to enhance the experiences of healthcare in clinical practice and human health. However, many cyber security issues often occur in the metaverse healthcare analytics such as DDoS attack, probe attack, and port scanning attack. Fortunately, 6G-enabled intrusion detection can detect anomalous activities with the help of an anomaly detection algorithm for metaverse healthcare analytics. Nevertheless, different from static data, data streams in metaverse healthcare have the intrinsic characteristics of infiniteness, correlation, and distribution change. Traditional static data anomaly detection algorithms do not consider these characteristics, which may result in low accuracy and efficiency. In this paper, a <underline>D</underline>ata <underline>S</underline>tream <underline>A</underline>nomaly <underline>D</underline>etection (DS_AD) approach driven by 6G network is proposed for metaverse healthcare analytics, which incorporates a sliding window and model update into LSHiForest. DS_AD uses a change detection mechanism to optimize the model update. The core design utilizes hash functions to partition data spaces to find anomalies. To validate the feasibility of DS_AD, multiple groups of experiments are designed and executed on SMTP and HTTP datasets. Experimental results show that compared with baselines, our proposal performs favorably for data streams in terms of accuracy and efficiency.