Shop Alto Essentials to add pharmacy products to any prescription delivery!

Your partner in navigating the ins and outs of prescriptions — at no extra cost.

Alto Pharmacy Technician

Alto Pharmacist

It’s official: Alto Pharmacy is a great place to work! We’re honored to join the community of Great Place to Work-Certified™ companies based on team member feedback and a rigorous assessment of our company’s culture and benefits.

Join us in delivering our industry-leading pharmacy care to millions of people across the country. As a member of the team, you’ll play an integral role in improving our customers’ quality of life and redefining what’s possible in pharmacy. 

Be Part of a Great Place to Work — Join Our Team

Hear first-hand from members of the Alto technology teams.

Read the latest Alto blog posts covering healthcare, family health, managing diseases, and other Alto highlights.

Blog | Alto Pharmacy

Many of us are spending more time on screens than ever before, as a growing number of social interactions take place online, along with work and school for many individuals. This prolonged exposure to digital devices can be hard on the eyes. Perhaps you’ve experienced achy eyes, blurred vision, headaches, or other symptoms of eye strain and screen fatigue yourself. The good news? There are steps you can take to lighten the load on your eyes and protect your vision.

Protect Your Eyes From Screen Fatigue

The causes of eye strain are twofold. First, your eyes have to work harder to see something close up, specifically the ciliary muscle, which contracts to support your focus. Hours of concentration on a single object causes that muscle to ache. This frequently occurs with screen use — which is why eye strain is often referred to as digital eye strain, screen fatigue, or computer vision syndrome — but it can also result from intense use of your eyes in other contexts. (The 20-20-20 rule, explained in more detail below, should come in handy for long reading sessions, too!)

Then there’s the effects of blue light, which is specific to screen-related eye strain. Digital devices like computers and mobile phones emit blue light to enhance the quality of images on your screen and help you stay alert. While this mimics the sun’s natural wavelengths, absorbing this high-energy light up close for an extended period of time strains your eyes. Not only does this contribute to screen fatigue, it can potentially damage your retina, the part of your eye that processes light and communicates to your brain.

Simple precautions can protect your eyes from screen fatigue, from the set-up of your home workspace to nutrition choices. Try the following to start.

The closer you are to a screen, the harder your ciliary muscle is working, so be sure there’s enough distance between your eyes and your computer screen. The American Academy of Ophthalmology recommends sitting about 25 inches from the screen, roughly an arm’s length away.

There are a variety of blue light-blocking tools that minimize its negative effects, including screen protectors for tablets, laptops, TVs, and phones. You may also want to ask your optometrist or ophthalmologist if blue light-filtering glasses would be a good fit for your needs. If you and your doctor have decided that these glasses are right for you, remember to put them on every time you use your computer, TV, or another digital device so that you can experience their full benefits.

Limiting your exposure to blue light becomes even more important later in the night, as it can affect your production of melatonin, potentially disrupting your sleep cycle. Many electronic devices give you the ability to shift your display to warmer colors more conducive to sleep, so be sure to make the switch before scrolling from bed. (Ditching screens before bedtime altogether is even better!)

Along with blue light, glare from a screen can also lead to eye strain. Be mindful of your computer or TV screen’s brightness in comparison to your surroundings, as high contrast between screen brightness and room lighting can strain your eyes. You may have to adjust these settings a couple times each day as the sun changes position. If using a laptop, tilting your screen so that your gaze is pointed downward may also help.

The less time spent staring at a screen, the better — for your eyes, your sleep, and other aspects of your overall health. But if work or school makes it difficult for you to step away from the screen for long periods of time, even short breaks help. Use the 20-20-20 rule to let your eyes rest: take a break every 20 minutes and look at an object 20 feet away for 20 seconds.

A balanced diet can combat the effects of blue light. Omega-3 fatty acids — found in nuts, seeds, and fish like tuna and salmon — and beta carotene — found in vegetables like pumpkin, carrots, and sweet potatoes — are known to boost eye health. Green, leafy vegetables like kale and spinach contain both beta carotene and Vitamin E, another nutrient that can protect your vision.

Stay current with annual vision check-ups

You may be more susceptible to eye strain when other unaddressed vision issues are present, so be sure to go in for regular eye appointments. Even if your vision is strong, it’s still important to have a full check-up every year as part of your overall preventative care.

At Alto, a pharmacist is your partner in health. If you take medication, we will work with your doctor, your insurance (if applicable), and any third party savings programs that you may qualify for to make your medications as affordable as possible. And our team of pharmacists is available to chat whenever questions come up.

Reach out any time through in-app secure messaging or by phone at 1-800-874-5881.

This content is not intended to be a substitute for professional medical advice, diagnosis, or treatment. Always seek the advice of your physician or another qualified health provider with any questions you may have regarding a medical condition.

While fertility preservation treatments like egg freezing and IVF are significant investments of time and resources, there are many ways to lower or manage the costs of treatment. As you prepare for the financial aspects of treatment, be sure to explore all of your options for financial assistance and savings, including patient assistance programs from fertility medication manufacturers.

A Guide to Ferring Pharmaceuticals’ Fertility Medication Savings Programs

If Alto is your fertility pharmacy, your fertility medication protocol may include medications manufactured by Ferring Pharmaceuticals, which has several financial assistance programs that offset the cost of fertility medications. Here’s more on eligibility for these programs and how to apply.

The OneHeart program provides a $200 rebate for out-of-pocket costs for select Ferring fertility medications. Eligibility is for those with no insurance coverage or commercial health insurance plans. In addition, you must have started your ovarian stimulation cycle between June 1, 2020 and June 30, 2022, with all medications purchased by June 30, 2022.

Learn more about program terms and conditions and the application process.

The HeartFelt program helps individuals whose cycles were canceled due to COVID-19 or a natural disaster resume fertility treatment. It offers medication replacement for up to 15 vials of Menopur® and up to five syringes of Fyremadel™ (ganirelix acetate) depending on the amount of medication used in the canceled cycle. Eligibility is for those with no insurance coverage or commercial insurance coverage.

To learn more about program terms and conditions and the application process, download the HeartFelt brochure on Ferring’s patient resources page.

The HeartTomorrow program provides Menopur® at $68 per vial for those undergoing an elective egg freezing cycle. To be eligible, you must be paying cash for your fertility medications and purchase a minimum of 20 vials in your first fill.

The Heart for Heroes program provides IVF medications at no cost to eligible military veterans who have experienced infertility due to a service-related injury or who do not have insurance coverage for fertility medications. To learn more about terms and conditions and the application process, call 1-800-515-3784.

The HeartBeat program provides select fertility medications at no cost for cancer patients. To be eligible, you must be a female U.S. citizen or permanent resident with a cancer diagnosis who has not received chemotherapy within the previous six months. To learn more about terms and conditions and the application process, call 1-888-347-3415. (Residents of Arkansas, Massachusetts, or New Jersey can call 1-877-252-0553.)

If your fertility medications are manufactured by EMD Serono, read our previous post for an overview of EMD Serono’s patient assistance programs. You can also read our previous posts on managing the costs of fertility treatment to learn about additional financial resources, including Alto’s financial support for fertility medications:

Managing the Costs of Fertility Treatment

A Financial Planning Guide for Egg Freezing

We’re here for you during fertility treatment

At Alto, we understand that fertility treatment is a physical, emotional, and financial investment, and we offer support with all aspects of your fertility journey.

We prioritize your financial wellness, working with your doctor, your insurance (if applicable), and any third party savings programs that you may qualify for to make your medications as affordable as possible. In addition to automatically applying any coupon savings, we’ll connect you with any outside programs that require you to apply directly.

We’re here to help with the rest of the process, too, with free same-day delivery of your medications, temperature controlled packaging, and fertility resources like personalized injection guide videos and one-on-one consultations with fertility-trained pharmacists.

To get a price quote specific to your fertility medication protocol, complete our online form.

All third party trademarks (including logos and icons) referenced by Alto Pharmacy remain the property of their respective owners. Unless specifically identified as such, Alto’s use of third party trademarks does not indicate any relationship, sponsorship or endorsement between Alto and the owners of these trademarks.

With one in ten Americans living with type 1 or type 2 diabetes and more than 88 million adults living with prediabetes, many more people have a connection to diabetes than it may seem. And whether you are living with diabetes yourself or care about someone who is, or if you simply want to know more about diabetes prevention, there’s no shortage of information to learn or actions to take. Thankfully, there are a variety of resources that can help, from online support groups and events to diabetes education programs and advocacy materials. Explore our diabetes resource round-up below to get started.

Diabetes Resource Round-up

With a mission of improving the lives of everyone affected by diabetes, the American Diabetes Association (ADA) is a comprehensive hub for diabetes research, education, advocacy, and support. The national organization also has local offices throughout the U.S. where you can learn about community resources and events.

Beyond Type 1 and Beyond Type 2 are global online communities for individuals living with diabetes, powered by a nonprofit organization (also named Beyond Type 1) that funds a variety of diabetes research and projects.

Focusing on type 1 diabetes, JDRF is a leader in research and advocacy and a destination for type 1 diabetes support and community. Like the ADA, JDRF has many chapters across the U.S. that offer opportunities to connect locally with those affected by type 1 diabetes.

Founded by an endocrinologist living with type 1 diabetes himself, Taking Control of Your Diabetes is a resource hub for individuals and families affected by diabetes as well as medical professionals seeking to stay informed of the latest developments in diabetes care.

ADA engagement platform, with opportunities to take action and raise awareness

Association of Diabetes Care & Education Specialists (ADCES) legislative action center

Beyond Type 1 community table, a monthly conversation series

ADCES diabetes education program directory

JDRF type 1 diabetes daily management page

Getinsulin.org, an insulin access resource

Johnson & Johnson Patient Assistance Program

Lilly Cares Foundation Patient Assistance Program

Novo Nordisk Diabetes Patient Assistance Program

ADA tips on nutrition, fitness, mental health, and more

ADA free type 1 diabetes self-care manual

JDRF type 1 diabetes health insurance guide 

Project Power, the ADA’s free virtual after-school diabetes prevention program for children

ADA summer camps and year-round programming for children with diabetes

ADA resources on school safety and diabetes

With a dedicated diabetes support team, Alto has deep expertise in diabetes management. Our extensive library of diabetes-focused content offers the information you need to manage the condition and live an active life. Here are a few of our top reads:

What’s the Difference between Type 1 and Type 2 Diabetes?

New Diabetes Diagnosis? Here’s What to Know

How to Manage Your Child’s Type 1 Diabetes Diagnosis

We make it simple to manage your diabetes, with free, same-day delivery right to your doorstep, temperature controlled packaging, and automatic savings investigations. And our dedicated diabetes team is here to offer individualized support and walk you through your first insulin doses.

Reach out any time through in-app secure messaging or by phone at 1-800-874-5881 to learn how Alto can be a partner in your diabetes care.

Vaccines — which were first developed in 1796 for smallpox and continue to evolve with new research and technology — build on your immune system’s natural function to protect you from serious diseases. Just like white blood cells and the other components of your immune system, vaccines help you develop immunity, but without the initial illness and risk of health complications. Here’s a look at how vaccines work.

The Science Behind Vaccines

Your immune system has a natural way of defending you from the viruses and bacteria that cause illness. As these germs multiply rapidly and infect your body, an army of white blood cells fights back, producing antibodies that attack the invaders.

The first time you are infected by a specific virus or bacteria, your immune system often cannot destroy the germ quickly enough to prevent you from becoming sick. After you’ve recovered, certain immune cells hold onto the memory of the infection. This allows them to mobilize quickly if they encounter the same germ again, preventing illness in the future. Immunity, your body’s resistance to certain types of infection, is the outcome of this process.

To understand how vaccines work, it’s helpful to know how your immune system naturally fights an infection. B-lymphocyte white blood cells produce blood proteins called antibodies, which attack antigens — the part of the invading germ that triggers an immune response. T-lymphocyte white blood cells attack already infected cells in the body. After the infection has ended, a few T-lymphocytes, or memory cells, remain to ensure a fast immune response should the same germ reappear.

Vaccines imitate infections, triggering the process of building immunity to a specific disease without causing illness. Your immune system responds to these imitation infections the same way it would to an actual infection. Detecting antigens from the vaccine, your immune system produces antibodies and T-lymphocyte cells. The imitation infection leaves your body with T-lymphocyte memory cells and B-lymphocytes, which will know how to quickly fight that antigen in the future. This prevents you from becoming sick if you are exposed to the virus or bacteria that cause the disease.

It typically takes several weeks for your body to produce T-lymphocyte and B-lymphocyte cells in response to a vaccine, which is why in most cases you will not immediately develop immunity. This means that you could become infected with a disease and develop symptoms shortly after vaccination, so it’s important to take necessary precautions until you become fully immune to the virus or bacteria. The healthcare professional administering your vaccine will inform you of the anticipated timeline for immunity.

Sometimes the imitation infection created by a vaccine causes mild symptoms such as a fever. These side effects are normal and indicate that your body is building immunity.

While all vaccines arrive at the end result of immunity, there are several paths for getting there. When deciding which type of vaccine to create for a disease, researchers consider a variety of factors, including the immune system’s response to the germ that causes the disease, the population likely to receive the vaccine, and the regions of the world where it will be used. These are the seven types of vaccines commonly used in the U.S.

Live vaccines use a weakened version of the living virus or bacteria that causes a disease. They are most similar to the natural infection and produce long-lasting immunity. The weakened form of the germ does not lead to serious disease, like that caused by the wild form of the germ, for most individuals with strong immune systems. However, live vaccines aren’t safe for those who are immunocompromised, including children undergoing cancer treatment. Examples of live vaccines include the measles, mumps, and rubella (MMR) vaccine and the chickenpox vaccine.

Inactivated vaccines are produced by inactivating, or killing, the germ that causes a disease. Examples include the polio, hepatitis A, and flu vaccines. They don’t provide as strong of immunity as live vaccines, so additional doses, also referred to as booster shots, are often needed for ongoing protection.

Toxoid vaccines target a toxin, a harmful substance produced by a germ, rather than the entire germ itself. They contain a weakened version of the toxin to be targeted called a toxoid, which teaches your immune system how to fight off the natural toxin. Similar to the germs used in live vaccines, toxoids are weakened to a point where they do not cause illness. These vaccines are used to prevent diseases caused by toxin-producing bacteria such as diphtheria and tetanus.

Subunit vaccines use portions of a virus or bacteria called subunits rather than the entire germ. Vaccines for diphtheria, tetanus, and pertussis, or whooping cough, are combined into the DTaP vaccine. The pertussis component is a subunit vaccine.

Conjugate vaccines fight a specific type of bacteria whose antigens are more difficult for a child’s immune system to detect due to their outer coating. The vaccines link the coating to stronger antigens that the immune system can more easily respond to. Like subunit vaccines, these vaccines are more targeted and only use part of the germ. Examples of conjugate vaccines include the haemophilus influenzae type B (Hib) vaccine.

Viral vector vaccines produce immunity to a virus by using a modified version of a different virus to deliver instructions to your immune cells. The modified version of the other virus is referred to as a vector virus. Recent Ebola vaccines have used this technology, and the Johnson & Johnson COVID-19 vaccine is also a viral vector vaccine.

mRNA vaccines help your body produce a protein that triggers an immune response and the development of antibodies. This technology was used to create the Pfizer-BioNTech and Moderna COVID-19 vaccines.

Read ‘What the COVID-19 Vaccine Means for Those With HIV’

All vaccines in the United States require approval by the Food and Drug Administration (FDA) and are held to rigorous safety and effectiveness standards. The vaccine approval process starts with lab tests, which may take years in some cases. The FDA analyzes the results to determine if the vaccine should be tested with people. If the vaccine moves forward, the next step is clinical trials where the vaccine is tested on volunteers.

Clinical trials typically begin with a smaller group of 20 to 100 volunteers before including thousands more. The trials gather information about vaccine safety, the typical immune response, and dosing. If any safety concerns emerge during this stage, the FDA must address them before it can authorize the vaccine.

Vaccine manufacturers are required to continuously monitor vaccine safety after approval and test every batch produced to ensure effectiveness, quality, and purity. These test results are reviewed by the FDA, which also conducts an inspection of the factory where the vaccine was produced. If you experience severe side effects after vaccination, contact your healthcare provider so that they can report potential concerns to the Centers for Disease Control and Prevention (CDC)’s vaccine monitoring database.

COVID-19 mRNA vaccines were developed and approved more quickly than a typical vaccine given the urgent nature of the pandemic. This expedited timeline was made possible by significant investment from governments and companies in the vaccine development process and decades of research on mRNA vaccine technology. These vaccines were as thoroughly vetted for quality and safety as any other vaccine.

Many vaccines are received during childhood, like the polio, chickenpox, and MMR vaccines, but there are others you may need as an adult. The CDC recommends the zoster vaccine, which prevents shingles, for adults ages 50 and older and the pneumonia vaccine for those over 65. Other vaccines may be recommended based on additional factors including job or school requirements, travel, and health conditions. Check in with your doctor about which vaccines you need.

The CDC also recommends an annual flu vaccine for everyone 6 months and older. New versions of flu vaccines are developed annually in anticipation of circulating flu virus strains, so health experts recommend getting one every year to prepare for cold and flu season. It’s especially important to be proactive about flu vaccination if you are over the age of 65 or have a chronic condition such as COPD or diabetes.

For detailed vaccine recommendations by age group, reference the CDC’s recommended immunization schedules for children and adolescents and adults.

At Alto, a pharmacist is your partner in health. If you take medication, we will work with your doctor, your insurance (if applicable), and any third party savings programs that you may qualify for to make your medications as affordable as possible. And our team of pharmacists is available to chat whenever questions come up. 

To automate a manual, error-prone pharmacy workflow, we turned to event streaming. Here’s what we learned from one of the first Kafka use cases at Alto.

How We Used Kafka to Build an Event-Driven Automation Pipeline and Scale Our Pharmacy

Imagine this: You're at the doctor’s office, and your doctor just wrote you a new prescription. Minutes later, before you even check out with the receptionist, you already have a notification from Alto Pharmacy on your phone that your prescription is ready. All you have to do is pick the date and time that works best for your free courier delivery.

This is the future we’re building at Alto: a future where a prescription can be transcribed, billed, and verified by a pharmacist in five minutes, flat. To get there without dramatically increasing Alto’s head count, we need to automate much of the process, starting with the first step: transcribing, or intaking, a prescription.

As a pharmacy, we receive prescriptions in many different forms. Some are sent electronically, in a structured format, but others are handwritten, phoned in, or even faxed. To represent all of these forms in a single table, we previously required every incoming prescription to be transcribed by an Alto team member, who would answer questions like:

Whom is this prescription for? Is this customer already in our system?

Where did this prescription come from? Who wrote it?

What is the relevant prescription information (medication to dispense, quantity, days supply, directions, etc.)?

This manual process is both time-consuming and prone to human error, which, if uncaught, could impact our ability to process the prescription downstream. Furthermore, at our busiest times, it could take up to two hours for a team member to get through the pending intake queue — unacceptable if we hope to have prescriptions ready to schedule before people even leave their doctor’s office. 

Automating intake required close collaboration between three teams:

Data Science, who built the decision-making algorithms 

Data Engineering, who served up the results of those algorithms

Product Engineering, who used those results to automatically intake prescriptions 

To allow the teams to operate in parallel without toe-stepping — and in the language most suitable for each (the Data Science and Data teams prefer Python, while product engineers work mainly in Ruby) — we separated the code into two environments: 

1. Data Prod Interface (DPI), where the code for generating automation results lives

2. Wunderbar (our proprietary pharmacy operations platform), where the code for requesting and using those automation results lives

The key question: to establish robust communication between these two environments, should we use an API-based approach, or an event-driven one? Each has its pros and cons. 

Legacy approach everyone at Alto is familiar with

Existing enforcement of strong types and data

Difficult to scale with increased data & requests

Requires ongoing authorization / authentication

Infrastructure relevant to other business areas

Automatic retries, reprocessing, and queueing

Our existing infrastructure currently utilizes a hefty API-based structure, so there was a natural tendency to go down this path, but we knew that beginning to migrate services towards an event-based architecture with Kafka at its heart would help us in the long term.

Kafka is a framework implementation developed by LinkedIn, now open-source with the Apache Software Foundation. It aims to provide a unified, high-throughput, and low-latency platform for handling real-time data feeds. 

Alto uses Amazon Web Services as our cloud provider, and luckily, they offer an out-of-the-box managed solution for Kafka, MSK. To configure Kafka with our system, our infrastructure team worked with AWS to set up managed instances to comply with our business requirements. Our Infrastructure team will share more details about this work in an upcoming blog post. 

Kafka offers many benefits. The asynchronous nature of the message system allows for retries, reprocessing, and queueing as well as easy recovery from outages. In addition, the infrastructure work done for setting up the managed cluster would be a one-off workstream. When complete, we’d be able to re-use the same setup and configurations across various business needs to streamline other projects that leverage Kafka. 

Setting up for success: defining a strict contract

One element we had to get right from the start was the data contract. As we send messages between DPI and Wunderbar, we need to ensure messages are produced with the correct schema, so that downstream consumers know what to expect.

Protocol Buffers, or Protos, is an open-source, cross-platform data format used to serialize structured data. Developed by Google, Protos allow you to define how you structure your data once and then use generated code to easily write and read the structured data in a variety of different languages. 

At Alto, we’ve been using Protos for the past few years to speed up development with auto-generated code and ensure data continuity between our Ruby on Rails backend and JavaScript / React / React Native frontend. Protos may seem antithetical to JavaScript and Ruby since they’re both dynamically typed languages, but in practice, they have saved us countless hours of debugging and back-and-forth Slack messages. 

For this project, we turned again to Protos to define the schema for messages produced by DPI and Wunderbar. We defined IntakeAutomationRequest and IntakeAutomationResult messages in Go and generated the types (Sorbet, Flow, etc.), which both DPI and Wunderbar now refer to when producing or consuming messages.

Because Wunderbar is already configured to run on AWS and houses our existing intake logic, it was easy enough to send a prescription to DPI for automation. Where we would normally create a task for an operations team member to manually transcribe the prescription, we instead produce a message to our “request automation” Kafka topic using the ruby-kafka library.

Our consumer, instantiated in an executable that runs on a dedicated worker, consumes messages from a “receive automation” Kafka topic. First, the consumer verifies that a given message corresponds to a prescription we previously sent to DPI. Then, it persists any automation results included in that message. If the automation results are sufficient, we skip intake altogether. Otherwise, we create an intake task to be handled by an operations team member.

Because this project was among our early use cases for Kafka, we wanted to be prepared for the worst-case scenario: we produce a message requesting automation results, and for whatever reason—maybe DPI is down—we don’t hear back. For us, we defined a reasonable time frame as fifteen minutes, in order to avoid building up a large backlog of work that would have to be offloaded back onto our operations team.
To this end, we store metadata about the automation lifecycle in an intake_automation_results table, which includes timestamps representing when we sent a message to DPI and when we received a response back. A cron job runs every minute to check that table for rows where received_at is blank, and sent_at was more than fifteen minutes ago. If this occurs, we flag the prescription to be manually intaken by an operations team member.

The diagram below illustrates our intake automation architecture.

Intake automation is now live at Alto. We’re seeing prescriptions fly through in just a few minutes — during which time our automation creates a user profile if one doesn’t already exist, links the new prescription to that profile, and finds and bills the user’s insurance; a pharmacist reviews the prescription for clinical accuracy; and the user receives a text message to schedule their delivery. This single flow, prior to intake automation, once took up to four hours to complete!

Going from zero to one is quite a feat, and it wouldn’t have been possible without an event-based approach. Now that intake automation has laid the groundwork, we know that Kafka will only continue to provide exponential value to Alto as we grow and migrate more of our services to this event-based architecture. 

Interested in learning more about engineering at Alto? Follow us on LinkedIn.

Inhalers and nebulizers are both effective at delivering medications for respiratory conditions like asthma and chronic obstructive pulmonary disease (COPD). A nebulizer is a device that transforms a liquid medication into a fine mist which is then inhaled into the lungs through a mouthpiece. While nebulizers take longer to deliver medications than inhalers, their accurate dosage delivery is often a good fit for children living with asthma and other lung diseases, and many adults find them helpful as well. Here’s what to know if you’re considering using a nebulizer.

What to Know About Nebulizers

Three types of nebulizers can be used to treat asthma, COPD, and other lung diseases like pulmonary fibrosis.

Jet nebulizers transform liquid medication into an aerosol or fine mist using an air compressor. They are the most common type of nebulizer.

Mesh nebulizers use a fine mesh to create an aerosol from the liquid medication. They are the newest type of nebulizer and emit the smallest particles.

Ultrasonic nebulizers create an aerosol through high-frequency vibrations. They are typically used in hospitals or at doctors’ offices.

There are different models of nebulizers, including portable, battery-run nebulizers that can be taken with you on the go and larger tabletop nebulizers that require an electrical outlet. These devices can deliver a variety of medications, including quick-relief medications that treat acute symptoms of lung diseases as well as longer-term maintenance medications. They may even be used to deliver more than one medication at once.

Your healthcare provider can advise you on the best method of medication delivery for your individual treatment plan. As you explore your options, be mindful of the key differences between nebulizers and inhalers.

Inhalers deliver medication quickly, but they require enough coordination to inhale and spray the medication at the same time. Some individuals, particularly young children, may find it challenging to properly use an inhaler. This can result in not receiving the full dose of medication.

To receive a dose of medication from a nebulizer, all that’s required is to breathe normally. However, nebulizers will take at least five to ten minutes to fully deliver the medication. You may want to ask your doctor which type of device they recommend for treating acute symptoms during an asthma attack or COPD flare-up.

If you and your doctor have decided that a nebulizer is a good fit for your needs, learning about proper use and cleaning of the device is a key part of managing your health. It will also ensure that you are taking your medication as prescribed. Be sure to follow your doctor’s instructions and review the manufacturer’s instructions for your nebulizer before using it for the first time, as there is some variation among these devices.

All nebulizers have a medicine cup, a mask and/or mouthpiece, an air compressor, and plastic tubing to connect the compressor to the medicine cup. Always wash and dry your hands before using your nebulizer and make sure that all the pieces of your nebulizer are clean. Pour the correct dose of your medication into the medicine cup and connect the tubing to the air compressor and medicine cup. Turn on your nebulizer and ensure that it’s properly working. You should see a fine mist coming from the mask or mouthpiece.

Once you see a mist appear, your nebulizer is ready for use. To inhale your medication, secure the mask over your nose and mouth or put the mouthpiece in your mouth. Sit upright and breathe normally. Taking slower breaths can help the medication enter your airways. Continue to breathe normally until the medication is gone from the cup.

Bacteria and other germs can grow inside of a nebulizer that has not been properly cleaned, so it’s important to clean your device after every use and disinfect it once a week.

After you’ve finished using your nebulizer, wash the mouthpiece or mask and the medicine cup in warm soapy water and let them air dry. For weekly disinfecting, soak these pieces in a vinegar solution for 30 to 60 minutes, or for the amount of time specified by your doctor or in the manufacturer’s instructions. Your doctor may provide you with a disinfectant solution, but if not, you can mix one part white vinegar with three parts hot water. After the pieces are done soaking, let them air dry. Put these pieces in a plastic container or bag and store it in a cool, dry place.

As part of nebulizer maintenance, you should replace the plastic tubing on a regular basis. Ask your healthcare provider how often to replace the tubing.

When deciding whether a nebulizer is a good fit for your needs, be sure to consider your health insurance benefits. Most insurance plans have separate medical and pharmacy benefits in addition to a Durable Medical Equipment (DME) section. Many nebulizers fall under the DME category of your policy. There may be restrictions on the brands, suppliers, or types of nebulizers that are available, and it’s important to check with your specific policy to understand what will be covered and under which sections.

Alto makes it easy to stay on top of your asthma or COPD treatment, with free hand-delivery, automatic savings investigations, and easy medication management tools through our website and app. And our team of pharmacists is always here to answer your questions by phone or chat. 

Inhalers and nebulizers are both effective at delivering medications for respiratory conditions like asthma and chronic obstructive pulmonary disease (COPD).

Each type of user has a different product or set of products we’ve built for them. From within each product, we collect, transmit, process, and store a tremendous amount of sensitive information. However, our biggest area of security, privacy, and compliance risk is our internal pharmacy management tool called Wunderbar that is used by our operations (ops) users every day to process prescriptions. Securing access to Wunderbar is mission-critical to protect our data and our business, and, of course, we need our super-secure implementation to be super-smooth to avoid slowing down our hard-working ops users.

Developing Robust Authentication Using Rails, Omniauth, and Okta

Alto Pharmacy aims to deliver a better pharmacy experience for everyone who needs medication. To achieve that, we need to enable three different types of users:

Individual customers who need prescriptions

Healthcare providers: the nurses, doctors, physicians assistants, and other medical professionals who prescribe medications

Operations users: the Altoids who intake prescriptions, bill insurance, fill prescriptions, and more

We wanted to be able to change our Wunderbar session lifetimes without hampering either our security efforts or the usability of our product. Moreover, we wanted session lifetimes of other apps to be able to change appropriately with business risk. Before starting this project, we’d implemented a Google OAuth 2.0 authorization flow that allowed ops users to log into Wunderbar via Google and take advantage of transparent session refresh for a limited amount of time.

However, while Google Workspaces was (and is) great for our email, documents, and calendars, it isn’t as configurable or extensible as a proper SSO solution. One painful side effect of this limitation was that, in order to ensure our refresh sessions were limited to twelve hours in Wunderbar, any user of the Alto Gmail drive also had to log back in every twelve hours just to see email — even though there’s not nearly the same level of sensitive data in email.

Plus, our IT team had already picked the tool of the future: Okta. And the goal was to enable SSO, or Single Sign On: if we still used Google for SSO, it wouldn’t really be SSO!

It was clear we needed to move to Okta for authenticating in Wunderbar, too.

Okta is a big company with many different authentication mechanisms. For us, the big question was really: do we want to authenticate via SAML or Open ID Connect (OIDC)? There are a lot of great resources around comparing these two standards and what they’re good at; here’s a good chart comparing and contrasting parts of these two authentication flows:

From this Medium post, which is a great primer on the differences

For us, the most attractive thing about SAML is that it can be used to provision user accounts from your upstream IDP; for example, Okta could be configured to push username, email, group, role, etc., information to our platforms with which we could automatically provision user accounts.

In the end, we decided the OIDC implementation would provide for a very similar user experience to that which our operations users were already accustomed to, with the same capability to perform transparent token refresh.

This transition was pretty easy because we were moving from Google OAuth 2.0 flow to Okta’s OIDC flow. OAuth 2.0 and OIDC are very similar; just know that OAuth 2.0 is technically an authorization framework (once you have a user, what can they access) vs an authentication framework (actually identifying and validating the user). However, there were some odd things about our previous implementation, and I only had one person to blame for those choices: myself. It’s great to get the opportunity to re-implement our authentication system — in a fast moving startup, you rarely get the chance to revisit problems so soon!

The biggest issue at hand with our previous Google flow was the way in which I’d chosen to re-authenticate users whose Wunderbar sessions had expired. In this case, OAuth provides a handy mechanism: a refresh token. Here’s how access tokens and refresh tokens are exchanged from the client and the authentication server in OAuth 2.0 flows:

At the time, we had session lifetimes of 60 minutes when accessing Wunderbar. These cookies also lasted 60 minutes. We faced a problem: if somebody walked away from their laptop for 61 minutes after authenticating, when they came back, how could we make it so they didn’t have to go back through the Google OAuth 2.0-initiated login flow from the beginning?

My solution at the time persisted a secure cookie with the refresh token value client-side with a longer expiration length. Then, if the user didn’t have a valid access token, we’d simply present the refresh token back to the server and get a new access token all over again. This worked well, but exposing secrets to the client always presents a risk of compromise. Refresh tokens are longer-lived, so they're of even higher value to protect!

Okta’s documentation made it very easy to stand up a simple authentication server and set up a local development server. Okta has a great blog post guide with tools we were already using (Rails and Omniauth, specifically) to get up and running. Beyond that, our biggest challenge was ensuring that we had a smooth rollout.

There was an issue in how we’d test and use this flow in our staging environments, however. At the time we were working on this (early 2020), there were two issues:

Our sandbox environment URLs were non-deterministic and could be varied depending upon how an engineer user named their cluster.

Okta apps did not support wildcard redirects in their oauth redirect URLs. This controls where, upon hitting Okta’s servers, they should redirect your payload to handle the meat of authentication.

For a time, our clever infrastructure engineering team managed around these issues with the use of an intermediary keycloak server. However, Okta now supports wildcard redirects that we’re successfully using today:

The biggest functional change to our authentication flow was in our refresh flow. The biggest challenge in landing this change was in how we deployed it to end users in production.

We didn’t want to expose the refresh token because it presented too much risk. What do we do instead? Something a little bit risky, but that we preferred after threat modeling our scenarios. Security engineering is often about making tradeoffs given a number of constraints. Today, our session lifetimes are down to fifteen minutes, and our refresh lifetime for an active session (e.g. somebody making at least one request within this window) is 60 minutes. If somebody comes back after their access token expires, that’s fine; we’ve persisted the encrypted refresh token to the database, and we can use attributes from the expired but still cryptographically valid token in order to look that refresh token up.

This was crucial for Okta especially because Okta refresh tokens are valid for 100 days by default!

Disruptive change is hard. We didn’t want to disrupt the workday of our hard-working ops users who are caring for our many customers and provider partners. The biggest intent here was to keep a safety blanket fallback to the old authentication flow until we were quite confident in its functionality. This broke down into a multi-phase approach:

1. Dark-launch the new Okta flow hidden behind a URL and with a small allow-list of users (mostly just the Security team) assigned to the new application in Okta.

2. Ask for volunteers! These volunteers would go about their normal work day in a variety of functional areas (customer care, pharmacy, fulfillment, engineering) using Okta instead of Google.

3. Change the default login flow to use Okta, but keep Google working just fine as a secondary action hidden behind a URL.

This allowed us to always ensure that we didn’t disrupt peoples’ days too much!

We achieved our goals and now, nearly two years later, we’re successfully using Okta’s OIDC flow within our core pharmacy management app. What did we learn in the process?

Not every API is necessarily fully implemented in every client. At the time of implementation, Okta’s Ruby client wasn’t fully supported. In order to support our refresh flow, we needed to upstream a small change into the client library, which required a little investigation.

Exposing secrets involves risk! In our case there wasn’t a glaring need to expose refresh tokens client-side at all.

Slow rollouts are great, especially with disruptive changes! A big thank-you to our team members who were willing to be part of the experiment group last year when this rolled out.

Interested in learning more about engineering at Alto? Follow us on LinkedIn and check out our open positions.

Whether traveling domestically or abroad, arriving at your destination with the medication you need is rarely as simple as packing it in your suitcase. From TSA compliance to temperature control, there are many factors to consider when traveling with medication — not to mention getting enough of a supply for the whole trip (plus extra, just in case).

Managing Your Medications While Traveling | Alto Pharmacy

Planning is key to managing your prescriptions and staying on top of your health needs while you’re away from home. Follow these tips to prepare for your next trip.

Research your destination’s medication laws

Many medications that are legal in the U.S. aren’t allowed in other countries. And it’s not only prescription medications: even over-the-counter treatment options may not be permitted in some destinations.

To avoid any unwelcome surprises while going through customs — or any missed doses — confirm that your medications are legal in the country you’re visiting. As a starting point, check with that country’s U.S. embassy. Consider that some countries may only allow a 30-day supply for certain medications and/or require you to carry an official prescription or additional information from your doctor with you. If you learn that your medication is not allowed at your destination, contact your healthcare provider to discuss your options.

There are legal considerations to be aware of even if you are traveling within the U.S. For example, you may be able to fill certain prescriptions out of state if you lose your medication or forget to order a refill before your trip, but the laws vary by state and there are often restrictions on controlled substances. Do your research in advance and make sure to prepare for any scenario.

Make sure you have enough of your medication

Unforeseen changes can happen when traveling, so it’s important to have more than enough medication on hand. Aim for an additional week or two’s supply. Allow yourself plenty of time to fill your prescription(s) before your trip. Depending on when you are due for a refill, you may need to request an early refill authorization from your insurance company — sometimes referred to as a vacation override — in order to get your medication in advance. (Alto can help with this!) 

In addition, make sure you’re prepared in the event that you misplace your medication during your trip. Write down the generic names of your medications, which may be more commonly available at pharmacies in other countries.

Blog

Protect Your Eyes From Screen Fatigue

A Guide to Ferring Pharmaceuticals’ Fertility Medication Savings Programs

Diabetes Resource Round-Up

The Science Behind Vaccines

How We Used Kafka to Build an Event-Driven Automation Pipeline and Scale Our Pharmacy

What to Know About Nebulizers

Developing Robust Authentication Using Rails, Omniauth, and Okta

Managing Your Medications While Traveling

Coronary Artery Disease, Explained

Inflammation, Explained

Tackling Technical Debt and Improving Security: How Alto Untangled an Overloaded User Model

What To Know About Insulin Pens

Switch to a better pharmacy.