Your partner in navigating the ins and outs of prescriptions — at no extra cost.

Alto Pharmacy Technician

Alto Pharmacist

It’s official: Alto Pharmacy is a great place to work! We’re honored to join the community of Great Place to Work-Certified™ companies based on team member feedback and a rigorous assessment of our company’s culture and benefits.

Join us in delivering our industry-leading pharmacy care to millions of people across the country. As a member of the team, you’ll play an integral role in improving our customers’ quality of life and redefining what’s possible in pharmacy. 

Be Part of a Great Place to Work — Join Our Team

Hear first-hand from members of the Alto technology teams.

Read the latest Alto blog posts covering healthcare, family health, managing diseases, and other Alto highlights.

Blog | Alto Pharmacy

Resources for Affording HIV Medication

The HIV treatment and prevention landscape continues to evolve, with many effective medications. Antiretroviral therapy (ART), the frontline treatment for HIV since 1997, is a combination of medications that lower the amount of HIV in your bloodstream. When taken as prescribed every day, ART can help individuals with HIV achieve and maintain an undetectable viral load. As a result, more than half of all those living with HIV in the U.S. are not at risk of transmitting the virus to others.

On the prevention front, PrEP, or pre-exposure prophylaxis, can lower risk of sexual transmission of HIV by 99% when taken daily and reduces the risk of getting HIV from intravenous drug use by about 74%.

For many individuals, cost is a barrier to both starting and continuing to take ART and PrEP as prescribed. Fortunately, HIV prevention medication and treatment continue to become more accessible, with generic PrEP options and expanded health insurance coverage of PrEP and ART. In addition, the following resources, including patient assistance programs and copay savings cards from medication manufacturers, can help reduce the cost of HIV treatment and prevention medication.

Read on to learn more about eligibility for these programs, and revisit our previous post on state-funded PrEP drug assistance programs.

Many pharmaceutical companies have patient assistance programs (PAPs) to offset the cost of prescription medications for individuals without insurance or with insufficient insurance coverage. If Alto is your pharmacy partner for HIV treatment or prevention, your medication protocol may include medications manufactured by Gilead, which offers the PAP outlined below.

If your medications are manufactured by a different company, contact them directly to learn about any available financial assistance including PAPs.

Gilead's Advancing Access® Patient Assistance Program

Gilead's Advancing Access Patient Assistance Program provides medication free of charge to individuals without insurance who meet program eligibility criteria. There are several ways to learn if you are eligible:

Call 1-800-226-2056 (Monday-Friday, 9 am to 8 pm EST)

Print the enrollment form and submit it via fax

Copay savings cards from pharmaceutical manufacturers can help offset the cost of prescription medications for individuals with insurance. If Alto is your pharmacy partner for HIV treatment or prevention, your medication protocol may include medications manufactured by Gilead or ViiV Healthcare, which offer the copay savings cards below.

If your medications are manufactured by a different company, contact them directly to learn about any available financial assistance including copay savings cards.

Gilead’s Advancing Access copay savings card

Gilead also offers a copay savings card for individuals with insurance to reduce the cost of copays. Those who are enrolled in any state or federally funded prescription medication program such as Medicare Part D and Medicaid, or who are in the Medicare Part D prescription coverage gap, are not eligible.

Learn more about program eligibility and terms and conditions.

The ViiVConnect Savings Card Program helps eligible individuals with commercial insurance save on copay costs for select ViiV Healthcare medications. Those who are enrolled in any state or federally funded prescription medication program such as Medicare Part D and Medicaid, or who are in the Medicare Part D prescription coverage gap, are not eligible.

If you do not have insurance coverage of prescription medications, contact 1-844-588-3288 to learn about additional financial assistance opportunities from ViiV.

Created to help individuals living with chronic health conditions access the treatment they need, the PAN Foundation offers financial assistance for medication costs, copays, and insurance premiums.

Learn what financial assistance you are eligible for.

The Ready, Set, PrEP program provides PrEP at no cost to eligible individuals without insurance coverage of prescription medications.

Learn more about program eligibility and the application process.

Your financial well-being is our priority

At Alto, we understand how stressful it can be to navigate insurance coverage benefits and savings opportunities. We prioritize your financial wellness, working with your doctor, your insurance (if applicable), and any third party savings programs that you may qualify for to make ART or PrEP as affordable as possible. In addition to automatically applying coupon savings, we’ll connect you with any outside programs that require you to apply directly.

We also offer free, same-day delivery to make it as easy as possible to stay on track with treatment, and our dedicated HIV support team is here to answer any questions you may have about ART or PrEP. Reach out any time via phone at 1-800-874-5881, or in-app messaging.

This content is not intended to be a substitute for professional medical advice, diagnosis, or treatment. Always seek the advice of your physician or another qualified health provider with any questions you may have regarding a medical condition.

All third party trademarks (including logos and icons) referenced by Alto Pharmacy remain the property of their respective owners. Unless specifically identified as such, Alto’s use of third party trademarks does not indicate any relationship, sponsorship or endorsement between Alto and the owners of these trademarks.

Millions of individuals with type 1 and type 2 diabetes need insulin every day to keep their blood sugar levels in a healthy range. In recent decades, it has grown increasingly difficult for many to access this life-saving medication, as insulin prices continue to rise.

Managing the Costs of Insulin

Millions of individuals with type 1 and type 2 diabetes need insulin every day to keep their blood sugar levels in a healthy range. In recent decades, it has grown increasingly difficult for many to access this life-saving medication, as insulin prices continue to rise. Take a look at these recent statistics:

The cost of insulin increased by an average of 14% every year from 2012 to 2018.

In 2017, insulin accounted for 20% of all diabetes-related healthcare spending before rebates and discounts and 6.3% after rebates and discounts.

In a 2018 survey on insulin affordability conducted by the American Diabetes Association, 39% of the respondents reported an increase in their insulin costs between 2017 and 2018.

Rising insulin costs can significantly impact an individual’s ability to manage their health. 27% of those surveyed by the ADA said that insulin prices affected how much of the medication they could buy or use. Missed insulin doses can lead to serious health complications including diabetic ketoacidosis.

While insulin access remains a critical issue for many Americans with diabetes, lawmakers have recognized the urgency of lowering insulin costs. In November 2021, the U.S. House of Representatives passed the Build Back Better Act, which caps out-of-pocket copays for insulin at $35 per month. The legislation has yet to pass in the U.S. Senate, but President Joe Biden recently reaffirmed his commitment to lowering insulin costs — and prescription medication costs more broadly — as part of his domestic agenda.

In the meantime, there are a variety of resources to help you manage the costs of insulin, including patient assistance programs and copay savings cards from insulin manufacturers. Here’s more on eligibility for these programs.

The Lilly Cares® Foundation Patient Assistance Program

The Lilly Cares Foundation Patient Assistance Program provides free insulin and glucagon products for individuals who have Medicare Part D or no health insurance coverage and meet certain income requirements.

Learn more about program terms and conditions and the application process.

The Novo Nordisk® Patient Assistance Program

The Novo Nordisk Patient Assistance Program provides insulin and other diabetes medications at no cost to individuals who have Medicare or no health insurance coverage and whose total household income is at or below 400% of the federal poverty level.

Sanofi Patient Connection provides Sanofi medications including insulin at no cost to individuals whose total household income is at or below 400% of the federal poverty level.

The Lilly Insulin Value Program offers all Lilly insulins at $35 per month to individuals with commercial health insurance or no health insurance coverage. Download the copay card here.

Sanofi offers a copay savings card for those with insurance as well as the Valyou Savings Program for those without insurance, which offers Sanofi insulin at $99 per month. Learn more about Sanofi savings opportunities.

Novo Nordisk offers savings cards that reduce copays for a variety of insulin products. Get more details here.

At Alto, we understand how stressful it can be to navigate insurance coverage benefits and savings opportunities. We prioritize your financial wellness, working with your doctor, your insurance (if applicable), and any third party savings programs that you may qualify for to make your insulin and other medications as affordable as possible. In addition to automatically applying any coupon savings, we’ll connect you with any outside programs that require you to apply directly.

We also offer free, same-day delivery to simplify your diabetes management, and our dedicated diabetes support team is here to answer any questions you may have. Get started or learn more about Alto, reach out any time through in-app secure messaging or by phone at 1-800-874-5881.

With more engineers contributing to Alto’s codebase than ever before, we needed to establish better boundaries: which team owns what? Here’s how we developed a tagging-based solution to code ownership and drove and measured adoption.

How We Established Better Boundaries and Clearer Code Ownership at Alto

Some problems are nice to have. Over the course of 2020 the engineering team at Alto saw explosive growth, expanding from about fifteen to more than seventy individual contributors. Growth at this pace required us to rethink our team structures and priorities more than once. This growth felt amazing: the new capacity enabled us to make progress on our backlogs like never before.

But still, there were challenges. We saw a steady rise in merge conflicts as more people contributed to the same code base. Build times increased as more and more code was contributed. A big influx of new perspectives and talent also meant new gaps in historical context and responsibility. New teams took big bites out of their new priorities — great! But what about the old ones? Who was going to fix that bug? Who needs to review this PR? Who is accountable for this performance problem?

Who, in short, owned what? By the end of 2020, it was clear to us that a good, practical, working answer to this question would be the critical first step to continuing smooth, rapid, distributed iteration on our product.

Up to this point, the large majority of product development at Alto had happened in the context of a Ruby on Rails monolith, which — over a half decade of intense development — had grown pretty large. We’d stuck more or less to the default Rails convention of organizing code by function rather than feature, which meant that our code was distributed across a few mostly flat and very broad subdirectories such as '/models' and '/controllers', making it difficult to learn much about the structure and ownership of our business domains by merely looking at how the code was laid out. We knew that this was not going to work for us over the long term.

Our long term vision started to coalesce around a notion of “better boundaries.” First, we would modularize the monolith along the lines suggested by Shopify’s packwerk utility. Then, we would carve some of those modules out into separate engines that could be built and tested separately. Finally, we’d deploy and operate some of those engines independently as their own services. Clear ownership was fundamental to this plan: on either side of an effective boundary, you need to know not just what it is but also who owns it. We lacked that clarity.

The RFC (Request for Comments) we ultimately adopted opened with four questions:

How might we produce a domain model and do something useful at the same time?

How will we avoid imposing (the wrong) prescriptive model from the top down?

How will we keep it up to date and accurate?

We considered jumping straight into moving files around into a more modular structure. Ultimately we decided against this approach as a first step for a number of reasons. The benefit of moving files around is mostly abstract — it’s not immediately clear what to do with a better module structure. It’s relatively expensive to move files around in a Rails app — doing so typically requires you to rename the contents (and update all its callers), which amounts to a lot of busy work, and it’s extra expensive to be wrong. And the in-between state is rough: which example should I follow in deciding where to put my new file? First you are obligated to create a map of the future state, and then to keep that map in sync with reality as you go.

Instead, we opted for a lightweight solution that would allow us to map our domains and their owners in the code itself — helping to ensure it’s up to date and accurate — without having to restructure it at the same time. We’d do this by tagging code in code comments, and then building tools to leverage these tags in various ways to increase visibility and enforce ownership. This has the nice effect of producing a new domain map incrementally from the bottom up, rather than prescriptively from the top down.

We called this the '@owners' tag, and it looks like this:

# @owners { team: platform, domain: orders }
class Wunderbar::OrdersController < Wunderbar::WunderbarController
  def show
		...
  end

  # @owners { team: inventory }
  def out_of_stock
    ...
  end
end

We based our tooling around extending the YARD documentation tool to recognize this as a custom tag. You can teach YARD to recognize a custom tag by passing a command line option like '--tag owners:"Owners"', which by default will cause the tag value to appear in generated documentation under the header “Owners”. The Ruby API for declaring a tag programmatically is shown in the snippet below as well.

We wanted the tag to be interpreted hierarchically to handle cases where ownership has diverged within the same class or module, such that we might want to tag one or two methods differently from the rest, as well as to ease the burden when all of the classes / modules / methods under a namespace belong to the same team and domain, since you can just tag the shared parent. We set an initial goal around getting 100% of our methods covered by at least a “team” value, at which point we would require all code to be covered in our build process.

To get a basic feel for how to work with these tags, make sure the 'yard' gem is available, tag a couple of your files, and then try running the code below in your project. It will print out the tag associated with each tagged code block.

require 'yard'
# Define the custom tag.
YARD::Tags::Library.define_tag('Owners', :owners)

# Parse your codebase. You might want to pass a more specific path here.
YARD.parse('.')

# Load all the method, class and module code blocks into memory
code_blocks = YARD::Registry.all(:method, :class, :module)

# Print the tag associated with each tagged block.
code_blocks.each do |code_block|
  tag = code_block.tag('owners')
  # automatically tag nested classes, modules and methods.
  while tag.nil? && code_block.namespace != nil && [:class, :module].include?(code_block.namespace.type)
    code_block = code_block.namespace
    tag = code_block.tag('owners')
  end
  print "Code Block: #{code_block}, tag: #{tag.text}, line: #{tag.line}" if tag
end

We ultimately developed a handful of CLI tools based on this technique that allow us to produce reports measuring the percentage of code covered by team and domain at different levels, among other things:

bin/yardowners --help
Usage: bin/yardowners [options]
        --methods                    view by methods
        --files                      view by files
        --teams                      teams report
        --domains                    domains repot
        --team=TEAM                  filter by team
        --domain=DOMAIN              filter by domain
        --codeowners                 update codeowners
        --lint                       lint owners tags
        --require-domains            lint for presence of domain in  
owners tags
    -h, --help                       display this help and exit

We use this CLI to add checks to our CI process around coverage / correctness, as well as to report progress toward our goals of 100% coverage.

To get the tagging process started across the organization, we dumped all of our class and module names (thanks again, YARD!) into a big spreadsheet, and then asked each team to get together and spend a bit of time putting their names next to the ones they owned. We adopted the attitude that it was better to have the wrong value than no value, since it would be easy to adjust later.

We covered a good 80% of the code using this spreadsheet by the time each team had taken an initial pass. From there, we filled the blanks in with “TODO”, and then wrote a little script to automatically insert the tags into the code (again based on the YARD metadata, which conveniently gives you the line numbers for the top of each class / module declaration).

At that point, we enabled a linter requiring 100% team owner coverage on all new PRs. We set a new goal to eliminate TODOs, and chipped away at it over the course of a month or so. We then repeated this process for the “domain” values, driving that to 100% as well. We found that the spreadsheet-based divide-and-conquer approach allowed us to cover a lot of ground very quickly.

Once we were able to parse our '@owners' tags, the first and most important thing we did with them was to automatically generate our CODEOWNERS file. We enforce that each tagged team maps to a team name in github and check that CODEOWNERS is up to date during the build process. This new process introduced some friction, as teams started getting tagged every time a file they were tagged on changed. This turned out to be great, because it sparked a number of very productive negotiations around ownership and scope that got hashed out in code review. We keep our CODEOWNERS file synced with Sentry, too, so that exceptions raised by files you tagged as yours get assigned to your team automatically. We also track and report on the performance of individual endpoints by team according to how they are tagged.

The new owners tag hasn’t fixed all our problems by any means, but it has proved fundamental to our ability to operate as a growing set of increasingly independent teams with well specified responsibilities. In subsequent posts, we’ll talk more about how we’re using our new domain map and a suite of other cool tools to build better boundaries within and ultimately escape from our monolith.

Interested in learning more about engineering at Alto? Follow us on LinkedIn.

While fertility preservation treatments like egg freezing and IVF are significant investments of time and resources, there are many ways to lower or manage the costs of treatment. As you prepare for the financial aspects of treatment, be sure to explore all of your options for financial assistance and savings, including patient assistance programs from fertility medication manufacturers.

A Guide to Ferring Pharmaceuticals’ Fertility Medication Savings Programs

If Alto is your fertility pharmacy, your fertility medication protocol may include medications manufactured by Ferring Pharmaceuticals, which has several financial assistance programs that offset the cost of fertility medications. Here’s more on eligibility for these programs and how to apply.

The OneHeart program provides a $200 rebate for out-of-pocket costs for select Ferring fertility medications. Eligibility is for those with no insurance coverage or commercial health insurance plans. In addition, you must have started your ovarian stimulation cycle between June 1, 2020 and June 30, 2022, with all medications purchased by June 30, 2022.

The HeartFelt program helps individuals whose cycles were canceled due to COVID-19 or a natural disaster resume fertility treatment. It offers medication replacement for up to 15 vials of Menopur® and up to five syringes of Fyremadel™ (ganirelix acetate) depending on the amount of medication used in the canceled cycle. Eligibility is for those with no insurance coverage or commercial insurance coverage.

To learn more about program terms and conditions and the application process, download the HeartFelt brochure on Ferring’s patient resources page.

The HeartTomorrow program provides Menopur® at $68 per vial for those undergoing an elective egg freezing cycle. To be eligible, you must be paying cash for your fertility medications and purchase a minimum of 20 vials in your first fill.

The Heart for Heroes program provides IVF medications at no cost to eligible military veterans who have experienced infertility due to a service-related injury or who do not have insurance coverage for fertility medications. To learn more about terms and conditions and the application process, call 1-800-515-3784.

The HeartBeat program provides select fertility medications at no cost for cancer patients. To be eligible, you must be a female U.S. citizen or permanent resident with a cancer diagnosis who has not received chemotherapy within the previous six months. To learn more about terms and conditions and the application process, call 1-888-347-3415. (Residents of Arkansas, Massachusetts, or New Jersey can call 1-877-252-0553.)

If your fertility medications are manufactured by EMD Serono, read our previous post for an overview of EMD Serono’s patient assistance programs. You can also read our previous posts on managing the costs of fertility treatment to learn about additional financial resources, including Alto’s financial support for fertility medications:

Managing the Costs of Fertility Treatment

A Financial Planning Guide for Egg Freezing

We’re here for you during fertility treatment

At Alto, we understand that fertility treatment is a physical, emotional, and financial investment, and we offer support with all aspects of your fertility journey.

We prioritize your financial wellness, working with your doctor, your insurance (if applicable), and any third party savings programs that you may qualify for to make your medications as affordable as possible. In addition to automatically applying any coupon savings, we’ll connect you with any outside programs that require you to apply directly.

We’re here to help with the rest of the process, too, with free same-day delivery of your medications, temperature controlled packaging, and fertility resources like personalized injection guide videos and one-on-one consultations with fertility-trained pharmacists.

To get a price quote specific to your fertility medication protocol, complete our online form.

Inhalers and nebulizers are both effective at delivering medications for respiratory conditions like asthma and chronic obstructive pulmonary disease (COPD). A nebulizer is a device that transforms a liquid medication into a fine mist which is then inhaled into the lungs through a mouthpiece. While nebulizers take longer to deliver medications than inhalers, their accurate dosage delivery is often a good fit for children living with asthma and other lung diseases, and many adults find them helpful as well. Here’s what to know if you’re considering using a nebulizer.

What to Know About Nebulizers

Three types of nebulizers can be used to treat asthma, COPD, and other lung diseases like pulmonary fibrosis.

Jet nebulizers transform liquid medication into an aerosol or fine mist using an air compressor. They are the most common type of nebulizer.

Mesh nebulizers use a fine mesh to create an aerosol from the liquid medication. They are the newest type of nebulizer and emit the smallest particles.

Ultrasonic nebulizers create an aerosol through high-frequency vibrations. They are typically used in hospitals or at doctors’ offices.

There are different models of nebulizers, including portable, battery-run nebulizers that can be taken with you on the go and larger tabletop nebulizers that require an electrical outlet. These devices can deliver a variety of medications, including quick-relief medications that treat acute symptoms of lung diseases as well as longer-term maintenance medications. They may even be used to deliver more than one medication at once.

Your healthcare provider can advise you on the best method of medication delivery for your individual treatment plan. As you explore your options, be mindful of the key differences between nebulizers and inhalers.

Inhalers deliver medication quickly, but they require enough coordination to inhale and spray the medication at the same time. Some individuals, particularly young children, may find it challenging to properly use an inhaler. This can result in not receiving the full dose of medication.

To receive a dose of medication from a nebulizer, all that’s required is to breathe normally. However, nebulizers will take at least five to ten minutes to fully deliver the medication. You may want to ask your doctor which type of device they recommend for treating acute symptoms during an asthma attack or COPD flare-up.

If you and your doctor have decided that a nebulizer is a good fit for your needs, learning about proper use and cleaning of the device is a key part of managing your health. It will also ensure that you are taking your medication as prescribed. Be sure to follow your doctor’s instructions and review the manufacturer’s instructions for your nebulizer before using it for the first time, as there is some variation among these devices.

All nebulizers have a medicine cup, a mask and/or mouthpiece, an air compressor, and plastic tubing to connect the compressor to the medicine cup. Always wash and dry your hands before using your nebulizer and make sure that all the pieces of your nebulizer are clean. Pour the correct dose of your medication into the medicine cup and connect the tubing to the air compressor and medicine cup. Turn on your nebulizer and ensure that it’s properly working. You should see a fine mist coming from the mask or mouthpiece.

Once you see a mist appear, your nebulizer is ready for use. To inhale your medication, secure the mask over your nose and mouth or put the mouthpiece in your mouth. Sit upright and breathe normally. Taking slower breaths can help the medication enter your airways. Continue to breathe normally until the medication is gone from the cup.

Bacteria and other germs can grow inside of a nebulizer that has not been properly cleaned, so it’s important to clean your device after every use and disinfect it once a week.

After you’ve finished using your nebulizer, wash the mouthpiece or mask and the medicine cup in warm soapy water and let them air dry. For weekly disinfecting, soak these pieces in a vinegar solution for 30 to 60 minutes, or for the amount of time specified by your doctor or in the manufacturer’s instructions. Your doctor may provide you with a disinfectant solution, but if not, you can mix one part white vinegar with three parts hot water. After the pieces are done soaking, let them air dry. Put these pieces in a plastic container or bag and store it in a cool, dry place.

As part of nebulizer maintenance, you should replace the plastic tubing on a regular basis. Ask your healthcare provider how often to replace the tubing.

When deciding whether a nebulizer is a good fit for your needs, be sure to consider your health insurance benefits. Most insurance plans have separate medical and pharmacy benefits in addition to a Durable Medical Equipment (DME) section. Many nebulizers fall under the DME category of your policy. There may be restrictions on the brands, suppliers, or types of nebulizers that are available, and it’s important to check with your specific policy to understand what will be covered and under which sections.

Alto makes it easy to stay on top of your asthma or COPD treatment, with free hand-delivery, automatic savings investigations, and easy medication management tools through our website and app. And our team of pharmacists is always here to answer your questions by phone or chat. 

Reach out any time through in-app secure messaging or by phone at 1-800-874-5881.

Inhalers and nebulizers are both effective at delivering medications for respiratory conditions like asthma and chronic obstructive pulmonary disease (COPD).

Last year, we set out to tackle this technical debt by splitting the User model into separate concerns and refactoring the entire system into this new paradigm.

Tackling Technical Debt and Improving Security: How Alto Untangled an Overloaded User Model

At Alto, we have three types of users: customers, healthcare providers (nurses, doctors, etc), and operations users who run the pharmacy. For each type of user, we maintain a separate application (though they share a monolithic backend for now): our customer app; our Alto Connect app for providers; and our internal pharmacy management tool called Wunderbar, which powers the pharmacy experience from prescription intake to fulfillment.

Early on, we made the pragmatic choice to represent both customers and operations users with a single User model, distinguishing them with a “roles” attribute. This required repetitive checks that, over time, slowed down our engineering teams, presented substantial privacy risk, and posed difficult scaling challenges as we evolved our monolith into different microservices. 

The challenges of relying on a single User model for different types of users

The notion of a User is core to our concept of identity from which authentication and authorization proceeds. From a security perspective, it’s difficult to build an extensible and clean authentication and authorization system when you’re overloading one model for two very different populations of users. From a privacy perspective, this muddied customer records (which are subject to more restrictions because they’re healthcare records) with workforce records, hamstringing many analytics efforts.

Authentication: Alto employees who were also Alto customers were required to use their work emails for their customer accounts. Not only was this restriction frustrating for Alto employees, but it also posed a security risk: employees should only be able to access Wunderbar via corporate SSO, not their personal account passwords. 

Authorization: Engineering new authorization capabilities required intricate knowledge of the idiosyncrasies of our user structure. This both slowed down development and created tremendous risk that any mistake could easily escalate user permissions.

Privacy: Because they existed in the same table, both customer records and Alto operations user records were classified as Protected Health Information, or PHI, which severely limited what we were able to do with them.

Attribution: Our robust audit logs were significantly less useful when a user ID in the transaction log might refer to either an ops user or a customer.

State management: Some updates pertaining to admin identity lived on the customer model, some lived on the employee model, and others lived in other various models.

Architecture: Tight coupling would have prevented us from decoupling our monolithic system into smaller services.

Our backend is primarily a monorepo Rails application that shares a tremendous amount of functionality between our customer, provider, and ops user-specific domains. Generally we use JWTs to secure customer and ops user sessions. These JWTs are issued only once valid credentials have been present.

Ops users are required to log in via Okta SSO, enforcing both valid username/password as well as a two-factor authentication (2FA) prompt. We use Devise and Omniauth to wire up the OIDC flow with our upstream identity provider, and we use CanCan to expand a set of roles per-user into a set of capabilities that restrict what resources they can access/modify.

Ops users primarily work in our internal pharmacy management app. However, the state of these users was shared between several different tables: Users, which otherwise refer to customers, and Employees, which share some ops user-specific state tied to Users.

Large change sets of code being deployed at once are harder to code review, harder to unwind if something goes wrong, and are more likely to be more disruptive. For this project, we knew that such a large architectural change had to be broken up into many more-digestible pieces if we were to be successful. The plan:

1. Create a new dedicated model for our ops users

# == Schema Information
#
# Table name: wunderbar_users
#
#  id                        :bigint(8)        not null, primary key
#  user_id                   :bigint(8)        indexed
#  email                     :string           not null, indexed
#  first_name                :string           not null
#  last_name                 :string           not null
#  token_last_invalidated_at :datetime
#  roles_mask                :integer          default(0), not null
#  title                     :string           not null
#  team                      :string           not null, indexed
#  is_active                 :boolean          default(TRUE), not null
#  slack_user_id             :string
#  pod                       :string

This was the easy part: create the database structure for a properly isolated admin user type, which we called a WunderbarUser.

We now had our admin user state split between Employees and Users, with a new table that engineers and analysts wanted to use that was not yet populated, and we had to make progress while allowing new hires and new customers alike to onboard to our platform.

2. Synchronize state between the old tables and new table

Next, we created a WunderbarUser for any User who was, or ever had been, a Wunderbar user. This required some historical digging —we had a lot of people who were onboarded, and even some offboarded, before we even had the intermediate Employee record!

Two major choices at this stage really helped the project succeed. First, we ensured that the WunderbarUser records all had IDs matching the corresponding User records. This is because a lot of our legacy audit records (that we’re required to preserve and keep useful as a Covered Entity under HIPAA) referenced an `admin_user_id` column populated with the ID of the User. If we just created all new entries for WunderbarUsers, these old logs would require at least one level of indirection (e.g. querying back to User) to make useful.

     # Create with the same ID as the user that we're creating this from.
     wunderbar_user_attributes = {
       id: user.id,
       user_id: user.id,
       email: user.email,
       roles_mask: user.roles_mask,
       date_of_birth: user.date_of_birth,
       token_last_invalidated_at: user.token_last_invalidated_at,
       first_name: user.first_name,
       last_name: user.last_name,
       preferred_first_name: user.preferred_first_name,
       is_active: false,
     }

Second, we created a new WunderbarUser any time we created a new Employee record (e.g. when we onboarded a new employee) and synchronized any changes between Users, Employees, and WunderbarUsers tables. As a side note: we knew we’d have to protect this syncing logic to ensure that we only copied each change once — otherwise, our callbacks would fire forever!

3. Migrate functionality slowly to use the new ops user model

We migrated logic to reference WunderbarUsers where previously we’d referenced Users and/or Employees. Authentication, authorization, audit logs, and pharmacist licenses were all updated here — albeit painstakingly!

We then migrated all of the foreign keys our various Postgres database tables held to either the Users or Employees tables to instead reference the WunderbarUsers. This ended up being around a hundred foreign keys, but a constraint-only migration that fortunately didn’t involve any data changes.

In short: our goal was to do this change slowly and steadily enough that nobody would notice until, one day, we could announce to the team, “Hey, we did a big security-pertinent project, and now you can change your customer email to be anything.”

Authentication: While we use the same JWT format for each, our customer and operations user authentication systems are now totally separated.

Authorization: With separate user types, we have separate capabilities and domain-specific authorization checks for each area, enforced in code.

Experience: Onboarding as a new Altoid (somebody who works here; come join us!) is totally separate from the customer experience, and you no longer need to link your accounts together.

Privacy: Our ops users who choose to be customers enjoy the full privacy afforded to our customers without tying their account to their work identity in any way.

Attribution: Legacy audit logs are still index-able and query-able with the same IDs, just in a slightly different table.

State management: Customer state lives on the User table, and ops user state lives on the new WunderbarUsers table. Our callbacks on each have been dramatically pared down, and our intermediary Employee table is entirely gone, along with a number of other now-ancillary tables.

Architecture: We have a clear path to federate RBAC checks without shipping our entire customer database between services.

Bonus: Performance and code readability generally improved by removing complex joins and join tables and isolating concerns between the customer and ops user domains.

Another Bonus: Significant refactorings and increased test coverage along the way while we cleaned up some very old, very stale code.

Large architectural changes of legacy systems with heavy use are rarely 100% smooth. Here are a few learnings to keep in mind the next time you tackle a hefty piece of technical debt. 

1. Always validate your assumptions (e.g. the data your constraints are against) when foreign keys are concerned. Multiple times we assumed, “Hey, we’ve migrated a bunch of really big tables that are really old (insurance claims, prescriptions, and more), so there’s no way we could have another admin user that we haven’t created a commensurate WunderbarUser for, right?” Wrong! Your data can always have inconsistencies, but a simple SQL query (e.g. validate that all values of the column you’re migrating the foreign key to have a matching WunderbarUser) can save a lot of time and headaches.

2. When migrating foreign key constraints on tables with active reads in Postgres, ensure you break it into two steps. Migrate your foreign key with `{ validate: false }`

 def up
   remove_foreign_key :inventory_orders, to_table: :users, column: :created_by_id
   add_foreign_key :inventory_orders, :wunderbar_users, column: :created_by_id, validate: false
 
   validate_constraint
 end

Validate the named constraint of your foreign key separately

 def validate_constraint
   validate_constraint_statement = 'ALTER TABLE "inventory_orders" VALIDATE CONSTRAINT "fk_rails_abcd1234";'
   ActiveRecord::Base.connection.execute(validate_constraint_statement)
 end

3. When working with legacy tables, be mindful of legacy systems. Our Billing service used a very outdated golang ORM that panicked if a column specified by the `struct` in source no longer existed; this caused a late-night outage that made auto billing requests back up the next day.

4. Scoping projects is hard! This was a larger project than our team had ever scoped and delivered before. Once all the dust settled, this project took several months longer than our initial scoping estimates.This project was worth doing, but better estimates allow us to prioritize better. If we’d had a great scope of this immense project upfront, would we have chosen to do it first? Also, this was a tremendously difficult project to separate into material stages; all the benefit was really backloaded.

In the end, this was a very satisfying and important project to complete. We wouldn’t have been able to accomplish it without a lot of help from our colleagues on the Platform team, the Security team, and across many other functions atAlto. Very large projects that involve a lot of moving pieces and impact other teams are always scary — but we can’t let that fear prevent us from making the changes we know we need to do in order to be successful long-term.

The Engineering Team is hiring! Learn more about open positions here.

If you take insulin daily to manage type 1 or type 2 diabetes, it’s important to choose a method of insulin delivery that fits your lifestyle and diabetes management needs. Many individuals who are often on-the-go find insulin pens to be most convenient given their portable size, discrete nature, and quick administration time. 

What to Know About Insulin Pens

Read on for more information about these devices, including the different types of insulin pens and what to consider when choosing one.

An insulin pen combines insulin and a syringe into a single device, allowing for a faster and easier administration than syringes. When it is time to administer an insulin injection, all you have to do is attach a new needle and dial the correct dosage on the pen. If you take multiple types of insulin every day, many insulin pen manufacturers offer color-coded pens or different designs to help you quickly identify each pen’s type of insulin.

While insulin pens simplify insulin delivery and how you measure your doses, you will still need to self-administer injections throughout the day. This is in contrast to an insulin pump, which automatically delivers doses of insulin at specific times. If you require many insulin injections each day, you may want to ask your healthcare provider if an insulin pump would be a good fit for your diabetes management needs.

There are two main types of insulin pens: disposable and reusable.

A disposable insulin pen contains a prefilled cartridge used for multidosing. You will discard the pen once the cartridge is empty or when the insulin expires, depending on the type of insulin you are using. These devices are sometimes referred to as “flex pens” or “quick pens.” Common brands include Lantus®, Tresiba®, Humalog®, Novolog®, and Basaglar®.

A reusable pen contains cartridges of insulin that are discarded once empty or when the insulin expires. You will replace the empty or expired cartridge with a new one and reuse the pen. These are sometimes referred to as “smart pens.” Common brands include InPen® and NovoPen®.

Follow the steps below to safely administer your insulin injections with a disposable or reusable insulin pen. A diabetes educator or healthcare provider can answer any questions and help you become more comfortable using the device.

1. Verify the expiration date of your insulin and do a visual check to make sure it has no clumps — most pens have a visible insulin reservoir. If the insulin is cloudy, roll the pen for a minute. (If the insulin is clear, you do not have to roll the pen.) If you take multiple types of insulin, make sure you are using the correct type.

2. Remove the pen cover or cap and sterilize the pen tip with alcohol using a cotton swab or gauze pad.

3. Attach a new needle to the pen, and have a sharps container ready for the used equipment. (You will need to use a new needle for each injection.)

4. Prime the pen if using it for the first time. Dial the dosage knob to two units, hold the pen with the needle pointing up, and tap the pen gently to let any air bubbles rise to the top. Press and hold the knob and look for a drop of insulin. If you do not see any insulin, repeat these steps as needed until at least one drop appears. This removes air bubbles from the needle and ensures that the needle is properly functioning. 

5. Choose an injection site, typically your abdomen, thigh, or arm, and wipe it with an alcohol swab. Hold the needle at the angle instructed by your doctor, most often a 90-degree angle.

6. Insert the needle into the skin and push the button on your insulin pen to deliver the injection. Wait ten seconds to make sure all of the insulin has been absorbed into your skin.

Unused pens must be refrigerated. However, do not place them in the freezer. Once in use, you may keep your insulin pen at room temperature. It’s important to avoid extreme temperatures as much as possible, so do not leave them anywhere where they will get too hot, like a car, or too cold. In addition, check the product’s package insert for an expiration date or consult your doctor about when to discard a pen or cartridge with unused insulin.

What to consider when choosing an insulin pen

You should consult with your doctor before choosing an insulin pen. In addition, consider the following factors:

The type of insulin you take — some insulin pens are only compatible with specific types of insulin.

Your insulin dosing needs — each pen has a maximum dosage. In addition, different pens can deliver insulin in increments of a half unit, one unit, or two units.

Your insurance coverage — ask your insurance provider what coverage they offer of insulin pens, if any, and explore the costs of other insulin delivery methods to determine the best fit for your needs.

Most insurance plans have separate medical and pharmacy benefits. In most cases, professional services provided by your doctor will fall under medical benefits while prescription diabetes medications — including insulin — will fall under pharmacy benefits. 

Some diabetes supplies, including many reusable insulin pens, are covered under a third type of benefits: the Durable Medical Equipment (DME) section of your policy. There may be restrictions on the brands or suppliers that are available, and it’s important to check with your specific policy to understand what will be covered and under which sections.

Many disposable insulin pens are often covered with your pharmacy benefits, in which case Alto may be able to help you get started with using an insulin pen. We will work with your insurance (if applicable) and any third party savings programs so that you can get your insulin pen at the lowest possible price.

A diabetes pharmacy partner you can rely on

At Alto, we believe a pharmacy should be a partner in your diabetes care. We have a dedicated diabetes support team to ensure that you have everything you need to follow through on your individualized treatment plan. Reach out any time through in-app secure messaging or by phone at 1-800-874-5881.

World AIDS Day, observed on December 1st every year, is an important reminder that progress in the global fight against AIDS requires action and awareness from each individual around the world.

Take Action for World AIDS Day 2021

World AIDS Day, observed on December 1st every year since 1988, is an important reminder that progress in the global fight against AIDS requires action and awareness from each individual around the world.

AIDS (acquired immunodeficiency syndrome) was heavily stigmatized from the beginning of the epidemic in the 1980s. Four years passed between the first cases of AIDS in the U.S. in 1981 and the Reagan administration’s first public mention of the disease. There were many misconceptions about how HIV (human immunodeficiency virus) — the virus that causes AIDS — can be transmitted and who is at risk of contracting it.

The stigma and lack of information about transmission and prevention led to many preventable cases of HIV/AIDS in the U.S. At the peak of the epidemic in 1995, complications from the disease were the leading cause of death for adults ages 25-44, and to date, more than 700,000 people in the U.S. have died from an HIV-related illness.

The HIV and AIDS landscape looks dramatically different today than it did back when World AIDS Day was first established. With greater awareness of HIV and AIDS, and more government funding of research, new HIV infections in the U.S. decreased by 73% between 1984 and 2019. Still, the fight to end AIDS isn’t over, with more than 1.2 million people living with HIV in the U.S.

In honor of World AIDS Day 2021, take a look at what has already been accomplished in the fight against AIDS and learn about what is needed next.

Blog

Resources for Affording HIV Medication

Managing the Costs of Insulin

How We Established Better Boundaries and Clearer Code Ownership at Alto

A Guide to Ferring Pharmaceuticals’ Fertility Medication Savings Programs

What to Know About Nebulizers

Tackling Technical Debt and Improving Security: How Alto Untangled an Overloaded User Model

What To Know About Insulin Pens

How to Take Action for World AIDS Day 2021

Introducing Alto Connect

A Financial Planning Guide for Egg Freezing

What Does a Diabetes Educator Do and How Can They Help You?

The Role of Insulin Pumps in Diabetes Treatment

Switch to a better pharmacy.