Shop Alto Essentials to add pharmacy products to any delivery!

Your partner in navigating the ins and outs of prescriptions — at no extra cost.

Alto Pharmacy Technician

Alto Pharmacist

It’s official: Alto Pharmacy is a great place to work! We’re honored to join the community of Great Place to Work-Certified™ companies based on team member feedback and a rigorous assessment of our company’s culture and benefits.

Join us in delivering our industry-leading pharmacy care to millions of people across the country. As a member of the team, you’ll play an integral role in improving our customers’ quality of life and redefining what’s possible in pharmacy. 

Be Part of a Great Place to Work — Join Our Team

Hear first-hand from members of the Alto technology teams.

Read the latest Alto blog posts covering healthcare, family health, managing diseases, and other Alto highlights.

Blog | Alto Pharmacy

Last summer, Moringa Fellows Irma Figueroa and Adrian Mendez joined Alto as the company’s second batch of engineering interns. Here, they share their learnings, accomplishments, and advice for future Alto interns.

Two Engineering Interns Weigh In: What to Expect From Your Alto Internship

The Moringa tree flourishes almost anywhere it’s planted. It’s hardy, fast-growing, and resistant to drought — an apt metaphor for the two interns who joined us from the Moringa Fellowship program last summer.

“Before Alto, I had never actually contributed to a large codebase,” admits Irma Figueroa, an intern on the Supply Chain Team. By the end of their three-month internships, however, Irma and fellow intern Adrian Mendez had shipped impactful features for Alto’s internal pharmacy management system and customer-facing app that are still in production today.

Below, we chat with Irma and Adrian to learn what it was like interning at Alto, which projects they worked on, and what advice they’d give to future interns. 

Adrian, who interned on the Patients Team before returning to join as a full-time software engineer last fall, was surprised by the freedom he had to choose what he worked on during his internship: “Early on, my manager gave me a rundown of the projects the team was juggling and the option to choose which one interested me the most,” he says. “I was able to decide the kind of experience I was going to have.” 

Adrian adds that meetings with his mentor evolved over the course of his internship, as he became more familiar with the codebase: “From the start, we had weekly meetings to talk about whatever was on my mind. Those meetings started off as general advice and questions and turned into more time to pair or run things by each other.”

Because both Adrian and his mentor were working on the same, long-term project, some of those meetings were also dedicated to project work. This included “sitting with [my mentor] while creating the project outline, pairing on larger tasks, and syncing up on progress.” 

Which projects did you work on during your internship? 

On the Supply Chain Team, Irma was tasked with a unique inventory challenge: Technicians at our production pharmacy locations use handheld scanners to scan the barcodes on newly-received inventory. Our technicians often need to scan hundreds of inventory items at a time — making it all too easy to lose track of which items have been successfully scanned onto which shelves. 

“I created a reusable counter component, displayed in the header of the scanner app, that would represent the number of items scanned into a shelf.” Irma says. The best part? Getting to test the handheld scanner herself. “I really enjoyed using the scanner for testing purposes. It was rewarding to see my code in action and definitely super fun!” 

On the Patients Team, Adrian worked on a project to add a homescreen to the customer-facing native app. Previously, the app dropped users into a list of all their active medications, which made it difficult to know where to look or what to do next. The new homescreen allows users to schedule the prescriptions most relevant to them and to view or edit any upcoming deliveries. 

“The first step was to create new additions to the design system — essentially taking the designs and extracting system-wide components. After that, the fun part was taking all those components and putting them together like building blocks!” Adrian says.

It was especially rewarding, he adds, to have been part of the project from start to finish. “I joined right as the design phase started, and I was there mostly every step of the way. For how short my time here was, having helped create this landmark project is really cool to think about.” 

What advice would you give to future Alto interns?

Irma and Adrian agree: Don’t be afraid to ask for help. “You'll often feel challenged and possibly intimidated, but be patient with yourself and remember you have an entire team of experienced engineers ready to help,” Irma says. 

“Everyone at Alto is more than willing to help you out, so don't be afraid to ask questions! You're on the same ship as everyone else, so your success equals everyone’s success,” Adrian adds. “Just remember that your work got you here, and they wouldn't have invited you if they thought you couldn't handle it. They made an investment in your ability to grow, so stay curious.” 

Interested in interning at Alto? Check out our careers page here.

For many individuals, the journey of living with type 2 diabetes starts early. Once referred to as adult-onset diabetes due to its prevalence among middle-aged and older Americans, the condition has become more common in children, adolescents, and young adults, due in part to growing childhood obesity rates. While some aspects of type 2 diabetes management, like glucose monitoring and healthy lifestyle choices, are important for all age groups, other parts of treatment may change with time. Here’s a snapshot of what type 2 diabetes may look like at each stage of life and tips for living with the condition.

Managing Type 2 Diabetes at Any Age

All type 2 diabetes treatment plans include healthy eating, frequent physical activity, and blood sugar monitoring regardless of age. Depending on a child or adult’s blood sugar levels and overall health, they may also need diabetes medication or insulin therapy to supplement these lifestyle changes. In addition to insulin, two other diabetes medications may be used to treat type 2 diabetes during childhood: metformin, an oral medication, and liraglutide, an injectable medication.

Younger children will need assistance with blood sugar monitoring, and if your child takes insulin, they will also need help with insulin administration. It’s important that teachers or other school staff are able to provide support during school days. Make sure that someone at the school is prepared to administer glucagon if your child’s blood sugar falls below a healthy range (known as hypoglycemia).

Inform your child’s teacher and/or other school staff of your child’s type 2 diagnosis before classes begin. Be sure to discuss daily treatment needs like blood sugar monitoring, insulin therapy, or other medication needs, as well as how to spot the signs and symptoms of low blood sugar. The American Diabetes Association (ADA) has resources that can help you start these conversations.

Living with type 2 diabetes as a young child can be emotionally challenging. It often helps to build connections with other children who are on the same journey. Explore programming for children with type 2 diabetes, like the ADA’s summer camps.

If your child is overweight, their doctor may recommend that you focus on slowing weight gain rather than losing weight since they are still growing. Follow your doctor’s recommendations and look for simple but impactful changes, like swapping carbohydrate-rich foods for a snackable fruit or vegetable, or trading soft drinks and fruit juices for water.

Whether you’ve had type 2 diabetes since childhood or are newly diagnosed, living with the condition as a young adult requires you to take an active role in the management of your health. It’s important to build a relationship with a care team that you trust to avoid any gaps in your treatment. Depending on your treatment plan, you may also have to learn about the logistics of filling prescriptions, ordering diabetes supplies, and coordinating with your insurance company.

Taking on additional responsibilities and navigating life more independently doesn’t mean that you’re completely on your own in managing your diabetes. If parents or another relative previously helped you with blood sugar monitoring, scheduling doctor’s appointments, or other aspects of care, use them as a resource during this transitional period as you become more confident managing your health. You may also want to expand your support system by working with a certified diabetes educator or connecting with other young adults living with type 2 diabetes.

Make sure you understand how other health issues can affect diabetes. For example, the common cold or flu can impact your calorie intake and blood sugar levels, so it’s important to be prepared to manage other illnesses. Alcohol safety is also extra important when living with type 2 diabetes, as alcohol is a factor in your blood sugar levels. For those taking insulin, be mindful of how alcohol use affects insulin therapy.

Build a diabetes care team you trust. In addition to seeing a primary care physician for general health issues, search for an endocrinologist who specializes in diabetes treatment.

Familiarize yourself with all aspects of managing type 2 diabetes, from navigating health insurance to monitoring blood sugar. Consider working with a certified diabetes educator. These are healthcare professionals with extensive knowledge of the condition who can offer individualized support. You can also search for a diabetes education program.

Find opportunities to connect with other young adults learning how to manage type 2 diabetes, like the Beyond Type 2 community.

The progression of type 2 diabetes varies significantly by individual. While many individuals are just beginning the journey of living with the condition in their 30s or 40s, diabetes management may feel like second nature for those who were diagnosed at an earlier age. It’s also possible for a person’s treatment needs to evolve at this stage of life. If lifestyle changes and other medications are effective, you may be tapering off of insulin. Conversely, you may need to begin taking additional medications, such as insulin, in order to manage your diabetes even more effectively. As always, follow your care team’s recommendations for your specific needs.

Regardless of what type 2 diabetes looks like for you, one thing’s for certain: it’s important to stay on top of your care and put your health first even when life is at its busiest. Make sure there’s plenty of room in your calendar for physical activity and doctor’s appointments. If you take insulin, find the right delivery method for your schedule and lifestyle. Many people who work long days in a physical setting find insulin pumps and pens convenient as they eliminate the need to remember the timing of injections.

If you are considering starting a family, your doctor can help you plan to have a healthy pregnancy. Get clarity on your A1C targets — your average blood sugar levels over several months — and how long to maintain them before pregnancy. Once you become pregnant, make a doctor’s appointment as soon as possible to learn about any potential changes to your treatment plan.

Revisit your fitness routine, if needed, to find the right activities for your schedule. If you find it challenging to fit enough exercise into your life — ideally 150 minutes of moderate-intensity aerobic activity per week — try to fit shorter bursts of physical activity into your day. 

If you take insulin, consult with your doctor about insulin delivery options to find the best fit for your needs.

Choose a diabetes pharmacy partner that simplifies your treatment. At Alto, we consolidate all of your medications and supplies into a single monthly delivery, and our mobile app can help you manage all of your diabetes needs in one place.

Preventative care and healthy lifestyle choices take on additional importance when you’re living with diabetes, which increases your risk for other chronic conditions like heart disease, high blood pressure, high cholesterol, and dementia.

Many older adults with diabetes also have high blood pressure, which is linked to a higher risk for strokes and heart attacks as well as vision and kidney function. Stay on top of key numbers like your blood pressure and cholesterol levels, and follow your doctor’s recommendations for treatment. You may also want to ask your doctor about additional screenings related to your mental health or cognitive health, as older adults with diabetes are more likely to experience depression or cognitive impairment. (If caring for an older adult with diabetes, watch for the signs of depression and dementia.)

Stay current with vaccines, including the annual flu shot and the pneumonia vaccine. If you are unsure which vaccines you need, ask your doctor.

Ask your doctor about the recommended frequency of screenings for other health conditions, including cancer screenings and kidney function tests.

Find a loved one to help with insulin administration and recording blood sugar readings, if needed.

Managing diabetes is easier at any age with the right pharmacy partner by your side. The Alto app can help you manage all of your diabetes needs in one place, and our dedicated diabetes support team is here to offer guidance and make sure you have everything you need for your treatment.

Reach out any time through in-app secure messaging or by phone at 1-800-874-5881 to learn how we can support your diabetes care.

This content is not intended to be a substitute for professional medical advice, diagnosis, or treatment. Always seek the advice of your physician or another qualified health provider with any questions you may have regarding a medical condition.

Alto’s mission is to improve the quality of life for all who need medicine, building a pharmacy experience that serves people of all backgrounds. As we work toward a more inclusive and accessible healthcare system, we recognize the importance of diversity among physicians, pharmacists, nurses, and other public health figures. In honor of Black History Month, take a moment to learn about five influential Black healthcare leaders past and present — those who paved the way and those who continue to break barriers today

Five Black Healthcare Leaders to Celebrate

Alto’s mission is to improve the quality of life for all who need medicine, building a pharmacy experience that serves people of all backgrounds. As we work toward a more inclusive and accessible healthcare system, we recognize the importance of diversity among physicians, pharmacists, nurses, and other public health figures. In honor of Black History Month, take a moment to learn about five influential Black healthcare leaders past and present — those who paved the way and those who continue to break barriers today. (For additional inspiration, revisit the first post in this series.)

Dr. M. Jocelyn Elders: the first Black U.S. surgeon general

As a Black woman born to farmers in a rural, poverty-stricken area of Arkansas, M. Jocelyn Elders encountered numerous obstacles on her path to becoming the first Black U.S. Surgeon General in 1993. At 16, she met a doctor for the first time, but she didn't consider a profession in healthcare until she connected with Edith Irby Jones, the first Black person to attend the University of Arkansas Medical School, during college.

Throughout her career, Dr. Elders balanced clinical practice and research, increasing the public’s awareness of adolescent health issues. In 1987, Bill Clinton, then the governor of Arkansas, appointed Dr. Elders as head of the state’s Department of Health. The Arkansas state legislature mandated sexual education and substance misuse prevention programs in the K-12 curriculum in 1989 in large part because of Dr. Elders’ advocacy. During her tenure as Surgeon General, Dr. Elders continued to champion progressive policies, advocating for better sexual education programs, distribution of condoms in schools, and abortion rights. She remains active in the field of public health as a professor emeritus at the University of Arkansas School of Medicine.

Bernard J. Tyson: former CEO of Kaiser Permanente

As chairman and CEO of Kaiser Permanente, Bernard Tyson transformed the company’s services to account for social determinants of health like food access and affordable housing as well as the importance of mental health and wellness. He was also instrumental in the development of the Kaiser Permanente School of Medicine, which trains physicians to be not only clinicians, but patient advocates and innovators, too. By shining a spotlight on how social determinants of health contribute to disparities in health outcomes, Tyson leaves behind a legacy that reaches far beyond Kaiser’s services.

Nadine Burke Harris: first surgeon general of California

A physician, researcher, advocate, and California’s first surgeon general, Dr. Nadine Burke Harris has transformed how our society responds to childhood trauma. While running a health clinic in an underserved San Francisco neighborhood, she observed that preventative health practices and quality treatment didn’t resolve her patients’ risk for poor health outcomes. Drawing upon research from the CDC and Kaiser Permanente on adverse childhood experiences (ACEs), which linked early adversity to higher rates of chronic illness later in life, Dr. Burke Harris studied her own patients and found that more than 67% had experienced at least one ACE. She has helped increase public awareness of ACEs and toxic stress, advocating for universal screening of children and adolescents for signs of trauma. Her 2014 TED Talk, “How Childhood Trauma Affects Health Across the Lifetime,” has been viewed more than 7.5 million times, and she published The Deepest Well: Healing the Long-Term Effects of Childhood Adversity in 2018.

Dr. Patrice Harris: first Black female president of the American Medical Association

Despite not knowing any doctors while growing up in West Virginia, Dr. Patrice Harris’ passion for medicine started early. The board-certified psychiatrist initially planned to pursue pediatrics but shifted her focus after discovering an interest in psychiatry during medical school. Her focus on child psychiatry allows her to merge her passion for children with her expertise in mental health. Throughout her career, Dr. Harris has focused on the role of implicit bias within the medical profession and how unconscious biases among healthcare workers influence health disparities.

Dr. Harris’ involvement in the professional healthcare community spans many leadership positions at state and national organizations. She became the first Black woman elected as president of the American Medical Association in 2020. During her tenure, she focused on a variety of health issues, from opioid addiction to COVID-19. She previously chaired the AMA’s Opioid Task Force, providing evidence-based recommendations to clinicians with the goal of ending the opioid epidemic.

Betty Smith Williams: first Black graduate of the Frances Payne Bolton School of Nursing

Betty Smith Williams was the first Black student to earn a nursing degree from Cleveland’s Frances Payne Bolton School of Nursing, in 1954, and the first Black individual to teach at a higher education institution in the state of California, but her individual accomplishments are only a part of her legacy. Williams has helped ensure that today’s aspiring Black healthcare professionals have the opportunities and support to break down barriers of their own. She was instrumental in developing the National Black Nurses Association and the National Coalition of Ethnic Minority Nurse Associations, Inc. — initiatives that have elevated the voices of Black nurses within the profession. In uniting Black nurses, Williams hoped to create better health outcomes among the Black community. In her own words: "We had no voice, but we understood our culture and our unique needs better than anyone else.”

Join us in delivering our industry-leading pharmacy care to millions of people across the country. As a member of the team, you’ll play an integral role in improving our customers’ quality of life and redefining what’s possible in pharmacy. View our current openings.

Vaccines — which were first developed in 1796 for smallpox and continue to evolve with new research and technology — build on your immune system’s natural function to protect you from serious diseases. Just like white blood cells and the other components of your immune system, vaccines help you develop immunity, but without the initial illness and risk of health complications. Here’s a look at how vaccines work.

The Science Behind Vaccines

Your immune system has a natural way of defending you from the viruses and bacteria that cause illness. As these germs multiply rapidly and infect your body, an army of white blood cells fights back, producing antibodies that attack the invaders.

The first time you are infected by a specific virus or bacteria, your immune system often cannot destroy the germ quickly enough to prevent you from becoming sick. After you’ve recovered, certain immune cells hold onto the memory of the infection. This allows them to mobilize quickly if they encounter the same germ again, preventing illness in the future. Immunity, your body’s resistance to certain types of infection, is the outcome of this process.

To understand how vaccines work, it’s helpful to know how your immune system naturally fights an infection. B-lymphocyte white blood cells produce blood proteins called antibodies, which attack antigens — the part of the invading germ that triggers an immune response. T-lymphocyte white blood cells attack already infected cells in the body. After the infection has ended, a few T-lymphocytes, or memory cells, remain to ensure a fast immune response should the same germ reappear.

Vaccines imitate infections, triggering the process of building immunity to a specific disease without causing illness. Your immune system responds to these imitation infections the same way it would to an actual infection. Detecting antigens from the vaccine, your immune system produces antibodies and T-lymphocyte cells. The imitation infection leaves your body with T-lymphocyte memory cells and B-lymphocytes, which will know how to quickly fight that antigen in the future. This prevents you from becoming sick if you are exposed to the virus or bacteria that cause the disease.

It typically takes several weeks for your body to produce T-lymphocyte and B-lymphocyte cells in response to a vaccine, which is why in most cases you will not immediately develop immunity. This means that you could become infected with a disease and develop symptoms shortly after vaccination, so it’s important to take necessary precautions until you become fully immune to the virus or bacteria. The healthcare professional administering your vaccine will inform you of the anticipated timeline for immunity.

Sometimes the imitation infection created by a vaccine causes mild symptoms such as a fever. These side effects are normal and indicate that your body is building immunity.

While all vaccines arrive at the end result of immunity, there are several paths for getting there. When deciding which type of vaccine to create for a disease, researchers consider a variety of factors, including the immune system’s response to the germ that causes the disease, the population likely to receive the vaccine, and the regions of the world where it will be used. These are the seven types of vaccines commonly used in the U.S.

Live vaccines use a weakened version of the living virus or bacteria that causes a disease. They are most similar to the natural infection and produce long-lasting immunity. The weakened form of the germ does not lead to serious disease, like that caused by the wild form of the germ, for most individuals with strong immune systems. However, live vaccines aren’t safe for those who are immunocompromised, including children undergoing cancer treatment. Examples of live vaccines include the measles, mumps, and rubella (MMR) vaccine and the chickenpox vaccine.

Inactivated vaccines are produced by inactivating, or killing, the germ that causes a disease. Examples include the polio, hepatitis A, and flu vaccines. They don’t provide as strong of immunity as live vaccines, so additional doses, also referred to as booster shots, are often needed for ongoing protection.

Toxoid vaccines target a toxin, a harmful substance produced by a germ, rather than the entire germ itself. They contain a weakened version of the toxin to be targeted called a toxoid, which teaches your immune system how to fight off the natural toxin. Similar to the germs used in live vaccines, toxoids are weakened to a point where they do not cause illness. These vaccines are used to prevent diseases caused by toxin-producing bacteria such as diphtheria and tetanus.

Subunit vaccines use portions of a virus or bacteria called subunits rather than the entire germ. Vaccines for diphtheria, tetanus, and pertussis, or whooping cough, are combined into the DTaP vaccine. The pertussis component is a subunit vaccine.

Conjugate vaccines fight a specific type of bacteria whose antigens are more difficult for a child’s immune system to detect due to their outer coating. The vaccines link the coating to stronger antigens that the immune system can more easily respond to. Like subunit vaccines, these vaccines are more targeted and only use part of the germ. Examples of conjugate vaccines include the haemophilus influenzae type B (Hib) vaccine.

Viral vector vaccines produce immunity to a virus by using a modified version of a different virus to deliver instructions to your immune cells. The modified version of the other virus is referred to as a vector virus. Recent Ebola vaccines have used this technology, and the Johnson & Johnson COVID-19 vaccine is also a viral vector vaccine.

mRNA vaccines help your body produce a protein that triggers an immune response and the development of antibodies. This technology was used to create the Pfizer-BioNTech and Moderna COVID-19 vaccines.

Read ‘What the COVID-19 Vaccine Means for Those With HIV’

All vaccines in the United States require approval by the Food and Drug Administration (FDA) and are held to rigorous safety and effectiveness standards. The vaccine approval process starts with lab tests, which may take years in some cases. The FDA analyzes the results to determine if the vaccine should be tested with people. If the vaccine moves forward, the next step is clinical trials where the vaccine is tested on volunteers.

Clinical trials typically begin with a smaller group of 20 to 100 volunteers before including thousands more. The trials gather information about vaccine safety, the typical immune response, and dosing. If any safety concerns emerge during this stage, the FDA must address them before it can authorize the vaccine.

Vaccine manufacturers are required to continuously monitor vaccine safety after approval and test every batch produced to ensure effectiveness, quality, and purity. These test results are reviewed by the FDA, which also conducts an inspection of the factory where the vaccine was produced. If you experience severe side effects after vaccination, contact your healthcare provider so that they can report potential concerns to the Centers for Disease Control and Prevention (CDC)’s vaccine monitoring database.

COVID-19 mRNA vaccines were developed and approved more quickly than a typical vaccine given the urgent nature of the pandemic. This expedited timeline was made possible by significant investment from governments and companies in the vaccine development process and decades of research on mRNA vaccine technology. These vaccines were as thoroughly vetted for quality and safety as any other vaccine.

Many vaccines are received during childhood, like the polio, chickenpox, and MMR vaccines, but there are others you may need as an adult. The CDC recommends the zoster vaccine, which prevents shingles, for adults ages 50 and older and the pneumonia vaccine for those over 65. Other vaccines may be recommended based on additional factors including job or school requirements, travel, and health conditions. Check in with your doctor about which vaccines you need.

The CDC also recommends an annual flu vaccine for everyone 6 months and older. New versions of flu vaccines are developed annually in anticipation of circulating flu virus strains, so health experts recommend getting one every year to prepare for cold and flu season. It’s especially important to be proactive about flu vaccination if you are over the age of 65 or have a chronic condition such as COPD or diabetes.

For detailed vaccine recommendations by age group, reference the CDC’s recommended immunization schedules for children and adolescents and adults.

At Alto, a pharmacist is your partner in health. If you take medication, we will work with your doctor, your insurance (if applicable), and any third party savings programs that you may qualify for to make your medications as affordable as possible. And our team of pharmacists is available to chat whenever questions come up. 

Reach out any time through in-app secure messaging or by phone at 1-800-874-5881.

Each type of user has a different product or set of products we’ve built for them. From within each product, we collect, transmit, process, and store a tremendous amount of sensitive information. However, our biggest area of security, privacy, and compliance risk is our internal pharmacy management tool called Wunderbar that is used by our operations (ops) users every day to process prescriptions. Securing access to Wunderbar is mission-critical to protect our data and our business, and, of course, we need our super-secure implementation to be super-smooth to avoid slowing down our hard-working ops users.

Developing Robust Authentication Using Rails, Omniauth, and Okta

Alto Pharmacy aims to deliver a better pharmacy experience for everyone who needs medication. To achieve that, we need to enable three different types of users:

Individual customers who need prescriptions

Healthcare providers: the nurses, doctors, physicians assistants, and other medical professionals who prescribe medications

Operations users: the Altoids who intake prescriptions, bill insurance, fill prescriptions, and more

We wanted to be able to change our Wunderbar session lifetimes without hampering either our security efforts or the usability of our product. Moreover, we wanted session lifetimes of other apps to be able to change appropriately with business risk. Before starting this project, we’d implemented a Google OAuth 2.0 authorization flow that allowed ops users to log into Wunderbar via Google and take advantage of transparent session refresh for a limited amount of time.

However, while Google Workspaces was (and is) great for our email, documents, and calendars, it isn’t as configurable or extensible as a proper SSO solution. One painful side effect of this limitation was that, in order to ensure our refresh sessions were limited to twelve hours in Wunderbar, any user of the Alto Gmail drive also had to log back in every twelve hours just to see email — even though there’s not nearly the same level of sensitive data in email.

Plus, our IT team had already picked the tool of the future: Okta. And the goal was to enable SSO, or Single Sign On: if we still used Google for SSO, it wouldn’t really be SSO!

It was clear we needed to move to Okta for authenticating in Wunderbar, too.

Okta is a big company with many different authentication mechanisms. For us, the big question was really: do we want to authenticate via SAML or Open ID Connect (OIDC)? There are a lot of great resources around comparing these two standards and what they’re good at; here’s a good chart comparing and contrasting parts of these two authentication flows:

From this Medium post, which is a great primer on the differences

For us, the most attractive thing about SAML is that it can be used to provision user accounts from your upstream IDP; for example, Okta could be configured to push username, email, group, role, etc., information to our platforms with which we could automatically provision user accounts.

In the end, we decided the OIDC implementation would provide for a very similar user experience to that which our operations users were already accustomed to, with the same capability to perform transparent token refresh.

This transition was pretty easy because we were moving from Google OAuth 2.0 flow to Okta’s OIDC flow. OAuth 2.0 and OIDC are very similar; just know that OAuth 2.0 is technically an authorization framework (once you have a user, what can they access) vs an authentication framework (actually identifying and validating the user). However, there were some odd things about our previous implementation, and I only had one person to blame for those choices: myself. It’s great to get the opportunity to re-implement our authentication system — in a fast moving startup, you rarely get the chance to revisit problems so soon!

The biggest issue at hand with our previous Google flow was the way in which I’d chosen to re-authenticate users whose Wunderbar sessions had expired. In this case, OAuth provides a handy mechanism: a refresh token. Here’s how access tokens and refresh tokens are exchanged from the client and the authentication server in OAuth 2.0 flows:

At the time, we had session lifetimes of 60 minutes when accessing Wunderbar. These cookies also lasted 60 minutes. We faced a problem: if somebody walked away from their laptop for 61 minutes after authenticating, when they came back, how could we make it so they didn’t have to go back through the Google OAuth 2.0-initiated login flow from the beginning?

My solution at the time persisted a secure cookie with the refresh token value client-side with a longer expiration length. Then, if the user didn’t have a valid access token, we’d simply present the refresh token back to the server and get a new access token all over again. This worked well, but exposing secrets to the client always presents a risk of compromise. Refresh tokens are longer-lived, so they're of even higher value to protect!

Okta’s documentation made it very easy to stand up a simple authentication server and set up a local development server. Okta has a great blog post guide with tools we were already using (Rails and Omniauth, specifically) to get up and running. Beyond that, our biggest challenge was ensuring that we had a smooth rollout.

There was an issue in how we’d test and use this flow in our staging environments, however. At the time we were working on this (early 2020), there were two issues:

Our sandbox environment URLs were non-deterministic and could be varied depending upon how an engineer user named their cluster.

Okta apps did not support wildcard redirects in their oauth redirect URLs. This controls where, upon hitting Okta’s servers, they should redirect your payload to handle the meat of authentication.

For a time, our clever infrastructure engineering team managed around these issues with the use of an intermediary keycloak server. However, Okta now supports wildcard redirects that we’re successfully using today:

The biggest functional change to our authentication flow was in our refresh flow. The biggest challenge in landing this change was in how we deployed it to end users in production.

We didn’t want to expose the refresh token because it presented too much risk. What do we do instead? Something a little bit risky, but that we preferred after threat modeling our scenarios. Security engineering is often about making tradeoffs given a number of constraints. Today, our session lifetimes are down to fifteen minutes, and our refresh lifetime for an active session (e.g. somebody making at least one request within this window) is 60 minutes. If somebody comes back after their access token expires, that’s fine; we’ve persisted the encrypted refresh token to the database, and we can use attributes from the expired but still cryptographically valid token in order to look that refresh token up.

This was crucial for Okta especially because Okta refresh tokens are valid for 100 days by default!

Disruptive change is hard. We didn’t want to disrupt the workday of our hard-working ops users who are caring for our many customers and provider partners. The biggest intent here was to keep a safety blanket fallback to the old authentication flow until we were quite confident in its functionality. This broke down into a multi-phase approach:

1. Dark-launch the new Okta flow hidden behind a URL and with a small allow-list of users (mostly just the Security team) assigned to the new application in Okta.

2. Ask for volunteers! These volunteers would go about their normal work day in a variety of functional areas (customer care, pharmacy, fulfillment, engineering) using Okta instead of Google.

3. Change the default login flow to use Okta, but keep Google working just fine as a secondary action hidden behind a URL.

This allowed us to always ensure that we didn’t disrupt peoples’ days too much!

We achieved our goals and now, nearly two years later, we’re successfully using Okta’s OIDC flow within our core pharmacy management app. What did we learn in the process?

Not every API is necessarily fully implemented in every client. At the time of implementation, Okta’s Ruby client wasn’t fully supported. In order to support our refresh flow, we needed to upstream a small change into the client library, which required a little investigation.

Exposing secrets involves risk! In our case there wasn’t a glaring need to expose refresh tokens client-side at all.

Slow rollouts are great, especially with disruptive changes! A big thank-you to our team members who were willing to be part of the experiment group last year when this rolled out.

Interested in learning more about engineering at Alto? Follow us on LinkedIn and check out our open positions.

Whether traveling domestically or abroad, arriving at your destination with the medication you need is rarely as simple as packing it in your suitcase. From TSA compliance to temperature control, there are many factors to consider when traveling with medication — not to mention getting enough of a supply for the whole trip (plus extra, just in case).

Managing Your Medications While Traveling | Alto Pharmacy

Planning is key to managing your prescriptions and staying on top of your health needs while you’re away from home. Follow these tips to prepare for your next trip.

Research your destination’s medication laws

Many medications that are legal in the U.S. aren’t allowed in other countries. And it’s not only prescription medications: even over-the-counter treatment options may not be permitted in some destinations.

To avoid any unwelcome surprises while going through customs — or any missed doses — confirm that your medications are legal in the country you’re visiting. As a starting point, check with that country’s U.S. embassy. Consider that some countries may only allow a 30-day supply for certain medications and/or require you to carry an official prescription or additional information from your doctor with you. If you learn that your medication is not allowed at your destination, contact your healthcare provider to discuss your options.

There are legal considerations to be aware of even if you are traveling within the U.S. For example, you may be able to fill certain prescriptions out of state if you lose your medication or forget to order a refill before your trip, but the laws vary by state and there are often restrictions on controlled substances. Do your research in advance and make sure to prepare for any scenario.

Make sure you have enough of your medication

Unforeseen changes can happen when traveling, so it’s important to have more than enough medication on hand. Aim for an additional week or two’s supply. Allow yourself plenty of time to fill your prescription(s) before your trip. Depending on when you are due for a refill, you may need to request an early refill authorization from your insurance company — sometimes referred to as a vacation override — in order to get your medication in advance. (Alto can help with this!) 

In addition, make sure you’re prepared in the event that you misplace your medication during your trip. Write down the generic names of your medications, which may be more commonly available at pharmacies in other countries.

Lost luggage can be more than an inconvenience if your medication is in your checked bag, so always pack any important medications in your carry-on. This does mean you’ll have to be mindful of security requirements, particularly if carrying liquid medication. The U.S. Transportation Security Administration (TSA)’s current limit on liquids, gels, and creams in a carry-on bag is 3.4 ounces (100 milliliters), but there are exceptions for liquid medications. For the easiest travel experience, inform the TSA officer that you are carrying more than 3.4 ounces of liquid medication before your screening process begins, and be aware that additional screening of your medication may be required.

Keep your medications in their original packaging to avoid any issues when passing through security or customs. You may want to bring an official prescription or other documentation of your medical condition as an additional precaution, especially if you take a controlled substance or are traveling abroad.

Many medications lose their effectiveness if held at extreme temperatures, which is another reason to put your medication in your carry-on, as a plane’s luggage compartment can be very cold. If you take a medication that requires refrigeration like insulin, make sure you have what you need to hold your medication at an appropriate temperature.

Many people with diabetes use insulated medication bags to refrigerate insulin when traveling. Read ‘How to Prepare a Diabetes Emergency Kit’ for more information on the diabetes essentials to bring on a trip.

If you’re traveling far from home, anticipate how time zone changes may impact your medication schedule. Before your trip, ask your doctor how to handle the time zone shift and what to do if you accidentally miss a dose — some medications have more flexible timing of doses than others. 

Getting a last-minute refill before a trip is low stress with a flexible pharmacy partner like Alto. We offer free same-day delivery seven days a week, with the convenience of choosing the best delivery window for your schedule. And we’ll work with your doctor, your insurance (if applicable), and any third party savings programs that you may qualify for to ensure your medications are as affordable as possible

Managing Your Medications While Traveling

Since certain types of cancer treatments and procedures can temporarily or permanently impact both male and female fertility, it’s important to have a discussion about fertility with your oncologist as soon as possible. Read on to learn more about fertility preservation options and financial resources for those recently diagnosed with cancer.

Fertility Preservation Options After a Cancer Diagnosis

A cancer diagnosis can bring much uncertainty. If you are considering having children in the future, you may be wondering how your options for cancer treatment will affect your reproductive health. Fertility preservation treatments like egg or sperm freezing can bring peace of mind during this potentially overwhelming time, allowing you to leave open the possibility of starting a family after cancer treatment.

There are several ways that cancer treatments can affect your fertility, including the following:

Surgery to treat cancer of a reproductive organ — such as in the prostate, testes, ovaries, or cervix — may lead to infertility.

Chemotherapy-induced changes in hormone levels can lead to early menopause for women and decrease sperm production in men.

Radiation therapy near the reproductive organs, abdomen, pelvis, or spine may damage eggs or sperm cells depending on the dose and level of radiation.

Hormone therapy used in the treatment of breast cancer and other types of cancer may affect fertility, though these effects are often temporary.

The extent to which these cancer treatments may impact your fertility depends on your personal health history — including your age and baseline fertility — and the duration and dosage of treatment. Your care team can provide a clearer sense of what to expect based on your health and treatment plan.

Many individuals of reproductive age choose to freeze their sperm or eggs for future use before beginning cancer treatment.

Sperm freezing is a fairly simple process in which a person’s sperm is collected, analyzed by a doctor, and, if viable, frozen in vials with cryoprotectant agents and stored for future use.

In the egg freezing process, fertility medications stimulate egg production and maturity. The eggs are retrieved in a minimally invasive procedure and then frozen and stored for future use. There is also the option of freezing embryos, which are eggs that have been fertilized with sperm.

There are several ways that you can use your frozen sperm, eggs, or embryos to have children biologically in the future after cancer treatment. Intrauterine insemination (IUI) is a process that allows you to use your frozen sperm and have it placed into your partner’s or a surrogate’s uterus.

In vitro fertilization (IVF) is a process in which eggs and sperm are fertilized and then placed into the uterus with the potential outcome of a pregnancy. Women who have previously undergone cancer treatment might use this process to have their frozen eggs or embryos implanted into their own uterus. If using eggs rather than embryos, there will be the additional step of fertilizing the eggs with a partner or donor’s sperm. If you had a hysterectomy to remove all or part of your uterus during cancer treatment, you can have your embryos implanted into a gestational carrier’s uterus.

Given the urgency of cancer treatment and the important timing of fertility medications during an egg freezing cycle, you will likely have to make quick decisions about fertility preservation, often within a few days of receiving a diagnosis. Your oncologist may refer you to a fertility specialist called a reproductive endocrinologist who can answer questions about cancer treatment and fertility and help you understand your fertility preservation options. It isn’t uncommon to begin taking fertility medications the same day as your consultation with a reproductive endocrinologist. 

If your oncology team does not know that fertility preservation is a priority for you, do not be afraid to take the initiative in starting the conversation. Be sure to get clarity on how moving forward with the fertility preservation process might impact the timing of your cancer treatment and what your oncologist recommends. Depending on your treatment plan, you may also want to ask about radiation shielding, which can be used during cancer treatment to protect the ovaries or testicles and limit how much radiation they are exposed to.

It’s important to take the financial aspects of fertility preservation treatments into account when planning for the future. While these treatments are significant financial investments, there are resources that can alleviate some of the costs of treatment, including programs designed specifically for those in cancer treatment and survivors.

If Alto is your fertility pharmacy, your fertility medication protocol likely includes medications manufactured by EMD Serono or Ferring Pharmaceuticals. Both companies offer financial assistance for individuals whose fertility has been affected by cancer treatment.

EMD Serono donates fertility medications to eligible cancer survivors diagnosed during their reproductive years through the Livestrong Fertility Discount program. Start the application process on Livestrong’s website to learn if you are eligible.

Ferring Pharmaceuticals provides some fertility medications at no cost for individuals pursuing fertility preservation before cancer treatment. To be eligible, you must be a female U.S. citizen or permanent resident with a cancer diagnosis who has not received chemotherapy within the previous six months. To apply, learn more about Ferring’s Heartbeat program online, or call 1-888-347-3415. (Residents of Arkansas, Massachusetts, or New Jersey can call 1-877-252-0553.)

Read our previous post on financial planning for egg freezing.

A fertility pharmacy partner you can rely on

Since 2016, Alto has supported more than 50,000 fertility journeys. We understand that fertility treatment is a significant investment — physically, emotionally, and financially — and we see ourselves as a partner in your health.

We offer free, same-day delivery seven days a week and temperature controlled packaging to ensure that your fertility medications always arrive in the right condition. And our fertility-trained pharmacists are available until 9 pm PST (12 midnight EST) on weeknights to offer any support you need.

Reach out any time through in-app secure messaging or by phone at 1-800-874-5881. You can also request a price quote online.

Face and fingerprint ID login is a convenient, seamless way to gain app access on a mobile device. Instead of typing in a lengthy, hard-to-remember username and password, many apps allow you login with just a quick scan of your face or fingerprint (also known as biometrics).

Considerations and Approaches for Implementing Biometric Login: Part 1

It's a desirable feature for both our end user and the Patients Team here at Alto — we want to make it as easy as possible for users to log in while also performing more frequent authentication checks. Improve the user experience and the security of our app? Sounds like a win-win.

As an engineer, implementing biometric login might seem easy, as mobile devices already capture, manage, and encrypt biometric data and expose APIs for app developers like myself to initiate a biometric scan. All I need to do is call that API and wait to hear if the scan is successful or not. What isn't as simple, though, is figuring out what to actually do with a successful biometric scan response. What does a successful scan mean, and how does that relate to the username and password credentials that users currently use to access our app?

This post walks through the decision points we encountered while implementing biometric login and how our healthcare privacy concerns influenced the final implementation approach.

Prior to implementing biometric login, the only way for users to access the Alto app was with email (username) and password. A valid email and password generates a session, which expires at some frequency. Once the session expires, the user must re-enter their email and password to regain access to the app.

From the beginning, we knew that biometrics would need to be built with our existing email and password session management in mind. This is made clear in the Apple developer docs: "Use biometrics as a supplement to something you’re already doing. Don’t depend on biometrics as your only authentication option."

Make it easier for users to login. Nobody likes typing in an email and password — especially on a mobile app. Our goal was to reduce the number of times a user must enter their email and password.

Enhance the security of our app using more frequent authentication checks. As a healthcare app that displays Personal Health Information (PHI), conducting more frequent authorization checks decreases the likelihood of PHI becoming exposed to an unauthorized third party.

Have the ability to revoke biometric access from a particular user. Similarly, we want to be extra careful to ensure that if a device is lost or stolen, we have a fallback plan to invalidate a user's session and protect the user’s PHI. For email and password initiated sessions, this happens when a user changes their password, as any change in login credentials will invalidate all active sessions for that user. We needed a similar contingency plan for biometric login.

There are several ways to use a mobile device's biometrics to authenticate a user, with varying degrees of security.

No server-side authentication. Simply integrate with the device's biometrics as an extra layer of authentication. If the biometric scan is successful, let the user proceed into the app.

Provides an extra check and gives your app a sense of modern polish

No server-side validation means that nothing is being validated against your system, so this is not a good substitute for account authentication. Therefore, even if you add this check, the user should still be prompted to re-enter their email and password at the same frequency as before.

Given this, this approach wouldn't help us reach our goal of reducing the number of times a user must enter their email and password.

This approach is a good fit if your application already has an existing login and session management system, and you want extra authentication checks throughout the user's session without modifying any other part of the system.

Tie biometrics to our existing email and password authentication. Use the user's biometrics to unlock an encrypted version of their email and password credentials. When a user sets up biometric login, store the user's login credentials within the device's keystore — the keystore will automatically encrypt the credentials. After a successful biometric scan, retrieve those credentials from the keystore and send them to your existing login API.

Still easy to implement, no backend changes needed

Biometric scan can be used in place of entering an email and password

Changing email and password credentials will revoke biometric access: if a user changes their credentials, their biometrics will access stale credentials and fail to login. (This is somewhat of a con as well — it provides a poor user experience, but it's an edge case that should happen infrequently.)

There is still only one way for a user to authenticate server-side, but now two ways to pass server-side authentication — essentially weakening your app's existing account security.

This approach effectively hands out internal login credentials to third party storage. While not a huge risk considering a device's secure storage is encrypted and trusted by most users, it’s not necessarily a best practice either.

This approach is a good fit if your application doesn't contain sensitive data, and your goal is to make it more convenient for a user to login by replacing email and password with a biometric scan.

Create a separate authentication mechanism for biometrics. Introduce a new authentication mechanism specifically for biometrics, resulting in two independent forms of server-side session authentication: email with password and biometrics. The implementation could look like generating a keypair or a shared secret to save and validate against the server whenever a user attempts to login with biometrics.

Biometrics is now tied to its own secure server-side authentication mechanism, which means it can be used independently of email/password (or even replace it, if you choose to).

Two layers of authentication adds security to the app. Not only does a user need a valid email/password session, they also need a valid biometric session.

Blog

Two Engineering Interns Weigh In: What to Expect From Your Alto Internship

Managing Type 2 Diabetes at Any Age

Five Black Healthcare Leaders to Celebrate

The Science Behind Vaccines

Developing Robust Authentication Using Rails, Omniauth, and Okta

Managing Your Medications While Traveling

Fertility Preservation Options After a Cancer Diagnosis

Considerations and Approaches for Implementing Biometric Login: Part 1

Hello Austin, We're Alto Pharmacy!

Celebrating National ERG Day at Alto

A Financial Planning Guide for Egg Freezing

Meet Ramiah Martin, VP, Operations & Supply Chain

Switch to a better pharmacy.