Shop Alto Essentials to add pharmacy products to any delivery!

Your partner in navigating the ins and outs of prescriptions — at no extra cost.

Alto Pharmacy Technician

Alto Pharmacist

It’s official: Alto Pharmacy is a great place to work! We’re honored to join the community of Great Place to Work-Certified™ companies based on team member feedback and a rigorous assessment of our company’s culture and benefits.

Join us in delivering our industry-leading pharmacy care to millions of people across the country. As a member of the team, you’ll play an integral role in improving our customers’ quality of life and redefining what’s possible in pharmacy. 

Be Part of a Great Place to Work — Join Our Team

Hear first-hand from members of the Alto technology teams.

Read the latest Alto blog posts covering healthcare, family health, managing diseases, and other Alto highlights.

Blog | Alto Pharmacy

Skin, the body’s largest organ, protects you against disease and infection and regulates your body temperature, among other crucial functions. It’s important to take good care of this vital and complex organ, as there are a variety of skin problems that can occur, including serious issues like skin cancer. Here’s what to know about the structure of your skin and how you can protect it.

An Introduction to Skin Health

Your skin is composed of three layers: the epidermis (top layer), the dermis (middle layer), and the hypodermis (bottom layer). Each layer has an important purpose.

The epidermis is what you see when you look at your skin. It prevents infections by blocking bacteria and germs from entering your bloodstream. There are three types of cells in the epidermis:

Squamous cells, which form the top layer of the epidermis

Basal cells, which sit beneath the squamous cells

Melanocytes, which produce melanin — the pigment that gives skin its color — and are located at the bottom of the epidermis

Skin cancer first develops in the epidermis, with the three most common types of skin cancer affecting one of the three cells above.

The dermis, the middle layer of skin, plays an important role in your overall skin health. It contains collagen, a protein that keeps skin cells strong and healthy, and blood vessels that deliver nutrients to the epidermis. In addition, its sweat glands help regulate your body temperature, its hair follicles stimulate hair growth, and its nerves allow you to experience the sensation of touch.

The bottom layer of your skin is the fattiest, cushioning your muscles and bones when you fall and protecting you from the cold or extreme heat. The dermis’ nerves and blood vessels continue in the hypodermis, where they expand and reach the rest of your body.

The sun emits a form of electromagnetic radiation called UV radiation that can damage the skin both directly and indirectly. This damage occurs gradually over time, potentially resulting in skin health issues such as:

Freckles, moles, and other benign skin growths

Skin cancer is one of the most common types of cancer in the U.S. It primarily occurs in parts of your body that receive the most sun exposure, such as your face, neck, hands, and arms, but it may develop anywhere.

Skin cancer can affect anyone, but you may be at a higher risk if you have lighter skin, a family history of skin cancer, prevalent moles, a history of severe sunburns, or a weakened immune system.

There are three common types of skin cancer: basal and squamous cell carcinomas, which develop in the epidermis’ basal and squamous cells, and melanoma, which develops in the melanocytes. Basal and squamous cell carcinomas are very treatable. Melanoma is the most serious type of skin cancer since it can spread to other organs if not detected early.

Limiting your exposure to UV rays is the most important thing you can do to prevent skin cancer and other types of skin damage. Wear a broad-spectrum sunscreen with a sun protection factor (SPF) of 15 or higher every day, even if it isn’t sunny, since up to 80% of UV rays can pass through clouds. Be extra careful around bright surfaces like snow, water, and sand, which can amplify UV exposure and increase your risk of a sunburn.

The strength of the sun’s rays fluctuates throughout each day, and from one day to the next. Avoid direct sunlight as much as possible between 10 am to 4 pm daylight savings time (9 am to 3 pm standard time), when UV radiation is at its strongest.

You are exposed to more UV radiation at higher altitudes, where more UV rays can reach the Earth’s surface. Check the UV Index for a daily forecast of local UV radiation strength on a scale of 0 to 11. Extra precautions against UV rays are recommended when the index is a three or higher. Protective clothing like long-sleeve shirts and wide-brimmed hats can help keep UV rays away from your skin.

It’s also best to avoid tanning beds, which use UV radiation and can increase your risk for skin cancer.

Unlike many other types of cancer, skin cancer is often visible. Checking your skin regularly to identify new or changing skin growths such as moles can help you detect any potential issues early on, when they will be easier to treat.

Skin cancer can take various forms. In general, if you see anything new, changing, or unusual, schedule an appointment with a dermatologist as soon as possible. Here are common signs of skin cancer to watch for, according to The Skin Cancer Foundation:

A skin growth that increases in size and appears pearly, transparent, tan, brown, black, or multicolored

A mole, birthmark, or brown spot that increases in size, thickness, changes color or texture, or is bigger than a pencil eraser

A spot or sore that continues to itch, hurt, crust, scab, or bleed

An open sore that does not heal within three weeks

You can also use the first five letters of the alphabet as a tool for recognizing melanoma warning signs in particular:

Asymmetry: Unlike a round or oval mole, melanomas tend to be asymmetrical, with one side of the growth appearing differently from the other. For example, one side may appear darker and raised while the other looks lighter and flat.

Border: The borders of melanomas are uneven, in contrast to the smoother borders of common moles.

Color: Benign moles are often just one shade of brown, but melanomas may have multiple shades of brown, tan, or black. Other colors like red, white, or blue may appear as it grows. Many health experts also consider it to be a melanoma warning sign if a skin growth is darker than others.

Diameter: While it’s best to detect melanoma before it grows, scan for any skin growth the size of a pencil eraser or larger, approximately ¼ inch in diameter.

Evolving: Changes in size, shape, color, or elevation may be a warning sign of melanoma. Watch for new symptoms like bleeding or itching as well.

Even if you don’t see anything unusual during these scans, it’s important to visit a dermatologist at least once a year for an exam as part of your overall preventative care.

At Alto, a pharmacist is your partner in health. If you take medication, we will work with your doctor, your insurance (if applicable), and any third party savings programs that you may qualify for to make your medications as affordable as possible. And our team of pharmacists is available to chat whenever questions come up. Reach out any time through in-app secure messaging or by phone at 1-800-874-5881.

This content is not intended to be a substitute for professional medical advice, diagnosis, or treatment. Always seek the advice of your physician or another qualified health provider with any questions you may have regarding a medical condition.

Many medications for respiratory conditions like asthma and chronic obstructive pulmonary disease (COPD) are taken by using a metered dose inhaler (MDI), also referred to as a hydrofluoroalkane (HFA) inhaler. These handheld devices — one of several types of inhalers used to treat asthma and COPD — are pressurized canisters of aerosol medication in a plastic container with a mouthpiece. They use a chemical propellant to release medication from the canister. 

The Right Way to Use a Metered Dose Inhaler

Many individuals use a plastic tube called a spacer with their metered dose inhaler, which can help ensure that the full dose of medication is received. Spacers may also be used to reduce side effects of corticosteroid inhalers such as mouth and throat irritation. Ask your doctor if a spacer is right for your health needs.

Taking your medication exactly as prescribed is critical to managing symptoms of asthma, COPD, and other lung diseases. If you and your doctor have decided that a metered dose inhaler is a good method of medication delivery for your treatment plan, it’s important to learn about proper use and cleaning of the device. Below, we explain how to use a metered dose inhaler with and without a spacer and share other considerations when using these devices.

The steps below offer a general overview of how to use a metered dose inhaler correctly. Consult with your doctor for more specific instructions. If using your inhaler for the first time, or if it’s been at least two weeks since your last use, be sure to prime your inhaler by spraying several puffs into the air to ensure that it is working.

1. Remove the cap from the inhaler and shake the inhaler for a few seconds. If using a spacer, remove the cap from the spacer and place the inhaler into the open end of the spacer.

2. If you are using your inhaler without a spacer, exhale completely and place the inhaler’s mouthpiece in your mouth and seal your lips around it. If you are using a spacer, place the spacer’s mouthpiece in your mouth first and then exhale completely.

3. Begin to inhale slowly, pressing down on the canister once.

4. Continue to inhale slowly and deeply for about five seconds.

5. Hold your breath for ten seconds so that the medication can enter your airways.

6. If your doctor has instructed you to take more than one puff of your medication, repeat these steps as needed, waiting about a minute between puffs.

If taking a corticosteroid medication, rinse your mouth with water after each dose to prevent mouth and throat irritation and oral yeast infections. Using a spacer will also minimize the chance of these side effects.

Cleaning your metered dose inhaler and spacer

Most metered dose inhalers can be cleaned by removing the medication canister and rinsing the plastic container under warm running water. If you are unable to remove the canister from the container, wipe the mouthpiece with a cloth or cotton swab. Refer to the manufacturer’s instructions for your inhaler as needed.

To clean your spacer, remove the soft ring at the end and soak both the tube and ring in warm water with light soap. Clean and rinse thoroughly and let the pieces air dry.

Frequency of cleaning depends on how often you take your medication. Consult with your doctor about when to clean your inhaler and spacer.

Keeping track of medication in your inhaler

It’s important to keep track of how much medication is left in your metered dose inhaler so that you can stay on top of refills and avoid any missed doses. For many metered dose inhalers, the total number of puffs will be printed on the medication canister. You must discard your inhaler after you have used that many puffs even if your inhaler continues to dispense medication. Priming puffs count toward the total number of puffs.

If you use a metered dose inhaler every day to take maintenance medication, divide the total number of puffs in your inhaler by the number puffs you take every day. That number is how many days you can use your inhaler before you need a refill. If you use your metered dose inhaler as needed for quick relief, you’ll have to keep track of each individual puff. Some metered dose inhalers now come with built-in counting devices, and there are also external dose counters that can attach to the inhaler. Ask your healthcare provider for recommendations.

There are other delivery methods available for asthma and COPD medications. Your healthcare provider can advise you on the best option for your individual treatment plan.

Dry powder inhalers are another option for medication delivery. Like metered dose inhalers, dry powder inhalers are a small handheld device, but the medication is in the form of a dry powder. Many dry powder inhalers provide a visual indication that the full dose of medication has been delivered, which is helpful for many individuals, as well as a built-in dose counter.

You can also take most asthma and COPD medications using a nebulizer, which transforms liquid medication into a fine mist. Nebulizers take longer than inhalers to deliver medication, but they are often helpful for those who find it difficult to properly use an inhaler. Many children with asthma use nebulizers.

Our team of pharmacists is here to help you get started with your medication for asthma or COPD. We can walk you through the steps of using your inhaler, discuss potential side effects, and answer any other questions you may have. In addition, we offer free, same-day delivery and medication management tools like reminders and auto refills in our app to make it as simple as possible to stay on track with managing your asthma. 

Reach out any time through in-app secure messaging or by phone at 1-800-874-5881.

Whether traveling domestically or abroad, arriving at your destination with the medication you need is rarely as simple as packing it in your suitcase. From TSA compliance to temperature control, there are many factors to consider when traveling with medication — not to mention getting enough of a supply for the whole trip (plus extra, just in case).

Managing Your Medications While Traveling | Alto Pharmacy

Planning is key to managing your prescriptions and staying on top of your health needs while you’re away from home. Follow these tips to prepare for your next trip.

Research your destination’s medication laws

Many medications that are legal in the U.S. aren’t allowed in other countries. And it’s not only prescription medications: even over-the-counter treatment options may not be permitted in some destinations.

To avoid any unwelcome surprises while going through customs — or any missed doses — confirm that your medications are legal in the country you’re visiting. As a starting point, check with that country’s U.S. embassy. Consider that some countries may only allow a 30-day supply for certain medications and/or require you to carry an official prescription or additional information from your doctor with you. If you learn that your medication is not allowed at your destination, contact your healthcare provider to discuss your options.

There are legal considerations to be aware of even if you are traveling within the U.S. For example, you may be able to fill certain prescriptions out of state if you lose your medication or forget to order a refill before your trip, but the laws vary by state and there are often restrictions on controlled substances. Do your research in advance and make sure to prepare for any scenario.

Make sure you have enough of your medication

Unforeseen changes can happen when traveling, so it’s important to have more than enough medication on hand. Aim for an additional week or two’s supply. Allow yourself plenty of time to fill your prescription(s) before your trip. Depending on when you are due for a refill, you may need to request an early refill authorization from your insurance company — sometimes referred to as a vacation override — in order to get your medication in advance. (Alto can help with this!) 

In addition, make sure you’re prepared in the event that you misplace your medication during your trip. Write down the generic names of your medications, which may be more commonly available at pharmacies in other countries.

Lost luggage can be more than an inconvenience if your medication is in your checked bag, so always pack any important medications in your carry-on. This does mean you’ll have to be mindful of security requirements, particularly if carrying liquid medication. The U.S. Transportation Security Administration (TSA)’s current limit on liquids, gels, and creams in a carry-on bag is 3.4 ounces (100 milliliters), but there are exceptions for liquid medications. For the easiest travel experience, inform the TSA officer that you are carrying more than 3.4 ounces of liquid medication before your screening process begins, and be aware that additional screening of your medication may be required.

Keep your medications in their original packaging to avoid any issues when passing through security or customs. You may want to bring an official prescription or other documentation of your medical condition as an additional precaution, especially if you take a controlled substance or are traveling abroad.

Many medications lose their effectiveness if held at extreme temperatures, which is another reason to put your medication in your carry-on, as a plane’s luggage compartment can be very cold. If you take a medication that requires refrigeration like insulin, make sure you have what you need to hold your medication at an appropriate temperature.

Many people with diabetes use insulated medication bags to refrigerate insulin when traveling. Read ‘How to Prepare a Diabetes Emergency Kit’ for more information on the diabetes essentials to bring on a trip.

If you’re traveling far from home, anticipate how time zone changes may impact your medication schedule. Before your trip, ask your doctor how to handle the time zone shift and what to do if you accidentally miss a dose — some medications have more flexible timing of doses than others. 

Getting a last-minute refill before a trip is low stress with a flexible pharmacy partner like Alto. We offer free same-day delivery seven days a week, with the convenience of choosing the best delivery window for your schedule. And we’ll work with your doctor, your insurance (if applicable), and any third party savings programs that you may qualify for to ensure your medications are as affordable as possible

Managing Your Medications While Traveling

Last year, we set out to tackle this technical debt by splitting the User model into separate concerns and refactoring the entire system into this new paradigm.

Tackling Technical Debt and Improving Security: How Alto Untangled an Overloaded User Model

At Alto, we have three types of users: customers, healthcare providers (nurses, doctors, etc), and operations users who run the pharmacy. For each type of user, we maintain a separate application (though they share a monolithic backend for now): our customer app; our Alto Connect app for providers; and our internal pharmacy management tool called Wunderbar, which powers the pharmacy experience from prescription intake to fulfillment.

Early on, we made the pragmatic choice to represent both customers and operations users with a single User model, distinguishing them with a “roles” attribute. This required repetitive checks that, over time, slowed down our engineering teams, presented substantial privacy risk, and posed difficult scaling challenges as we evolved our monolith into different microservices. 

The challenges of relying on a single User model for different types of users

The notion of a User is core to our concept of identity from which authentication and authorization proceeds. From a security perspective, it’s difficult to build an extensible and clean authentication and authorization system when you’re overloading one model for two very different populations of users. From a privacy perspective, this muddied customer records (which are subject to more restrictions because they’re healthcare records) with workforce records, hamstringing many analytics efforts.

Authentication: Alto employees who were also Alto customers were required to use their work emails for their customer accounts. Not only was this restriction frustrating for Alto employees, but it also posed a security risk: employees should only be able to access Wunderbar via corporate SSO, not their personal account passwords. 

Authorization: Engineering new authorization capabilities required intricate knowledge of the idiosyncrasies of our user structure. This both slowed down development and created tremendous risk that any mistake could easily escalate user permissions.

Privacy: Because they existed in the same table, both customer records and Alto operations user records were classified as Protected Health Information, or PHI, which severely limited what we were able to do with them.

Attribution: Our robust audit logs were significantly less useful when a user ID in the transaction log might refer to either an ops user or a customer.

State management: Some updates pertaining to admin identity lived on the customer model, some lived on the employee model, and others lived in other various models.

Architecture: Tight coupling would have prevented us from decoupling our monolithic system into smaller services.

Our backend is primarily a monorepo Rails application that shares a tremendous amount of functionality between our customer, provider, and ops user-specific domains. Generally we use JWTs to secure customer and ops user sessions. These JWTs are issued only once valid credentials have been present.

Ops users are required to log in via Okta SSO, enforcing both valid username/password as well as a two-factor authentication (2FA) prompt. We use Devise and Omniauth to wire up the OIDC flow with our upstream identity provider, and we use CanCan to expand a set of roles per-user into a set of capabilities that restrict what resources they can access/modify.

Ops users primarily work in our internal pharmacy management app. However, the state of these users was shared between several different tables: Users, which otherwise refer to customers, and Employees, which share some ops user-specific state tied to Users.

Large change sets of code being deployed at once are harder to code review, harder to unwind if something goes wrong, and are more likely to be more disruptive. For this project, we knew that such a large architectural change had to be broken up into many more-digestible pieces if we were to be successful. The plan:

1. Create a new dedicated model for our ops users

# == Schema Information
#
# Table name: wunderbar_users
#
#  id                        :bigint(8)        not null, primary key
#  user_id                   :bigint(8)        indexed
#  email                     :string           not null, indexed
#  first_name                :string           not null
#  last_name                 :string           not null
#  token_last_invalidated_at :datetime
#  roles_mask                :integer          default(0), not null
#  title                     :string           not null
#  team                      :string           not null, indexed
#  is_active                 :boolean          default(TRUE), not null
#  slack_user_id             :string
#  pod                       :string

This was the easy part: create the database structure for a properly isolated admin user type, which we called a WunderbarUser.

We now had our admin user state split between Employees and Users, with a new table that engineers and analysts wanted to use that was not yet populated, and we had to make progress while allowing new hires and new customers alike to onboard to our platform.

2. Synchronize state between the old tables and new table

Next, we created a WunderbarUser for any User who was, or ever had been, a Wunderbar user. This required some historical digging —we had a lot of people who were onboarded, and even some offboarded, before we even had the intermediate Employee record!

Two major choices at this stage really helped the project succeed. First, we ensured that the WunderbarUser records all had IDs matching the corresponding User records. This is because a lot of our legacy audit records (that we’re required to preserve and keep useful as a Covered Entity under HIPAA) referenced an `admin_user_id` column populated with the ID of the User. If we just created all new entries for WunderbarUsers, these old logs would require at least one level of indirection (e.g. querying back to User) to make useful.

     # Create with the same ID as the user that we're creating this from.
     wunderbar_user_attributes = {
       id: user.id,
       user_id: user.id,
       email: user.email,
       roles_mask: user.roles_mask,
       date_of_birth: user.date_of_birth,
       token_last_invalidated_at: user.token_last_invalidated_at,
       first_name: user.first_name,
       last_name: user.last_name,
       preferred_first_name: user.preferred_first_name,
       is_active: false,
     }

Second, we created a new WunderbarUser any time we created a new Employee record (e.g. when we onboarded a new employee) and synchronized any changes between Users, Employees, and WunderbarUsers tables. As a side note: we knew we’d have to protect this syncing logic to ensure that we only copied each change once — otherwise, our callbacks would fire forever!

3. Migrate functionality slowly to use the new ops user model

We migrated logic to reference WunderbarUsers where previously we’d referenced Users and/or Employees. Authentication, authorization, audit logs, and pharmacist licenses were all updated here — albeit painstakingly!

We then migrated all of the foreign keys our various Postgres database tables held to either the Users or Employees tables to instead reference the WunderbarUsers. This ended up being around a hundred foreign keys, but a constraint-only migration that fortunately didn’t involve any data changes.

In short: our goal was to do this change slowly and steadily enough that nobody would notice until, one day, we could announce to the team, “Hey, we did a big security-pertinent project, and now you can change your customer email to be anything.”

Authentication: While we use the same JWT format for each, our customer and operations user authentication systems are now totally separated.

Authorization: With separate user types, we have separate capabilities and domain-specific authorization checks for each area, enforced in code.

Experience: Onboarding as a new Altoid (somebody who works here; come join us!) is totally separate from the customer experience, and you no longer need to link your accounts together.

Privacy: Our ops users who choose to be customers enjoy the full privacy afforded to our customers without tying their account to their work identity in any way.

Attribution: Legacy audit logs are still index-able and query-able with the same IDs, just in a slightly different table.

State management: Customer state lives on the User table, and ops user state lives on the new WunderbarUsers table. Our callbacks on each have been dramatically pared down, and our intermediary Employee table is entirely gone, along with a number of other now-ancillary tables.

Architecture: We have a clear path to federate RBAC checks without shipping our entire customer database between services.

Bonus: Performance and code readability generally improved by removing complex joins and join tables and isolating concerns between the customer and ops user domains.

Another Bonus: Significant refactorings and increased test coverage along the way while we cleaned up some very old, very stale code.

Large architectural changes of legacy systems with heavy use are rarely 100% smooth. Here are a few learnings to keep in mind the next time you tackle a hefty piece of technical debt. 

1. Always validate your assumptions (e.g. the data your constraints are against) when foreign keys are concerned. Multiple times we assumed, “Hey, we’ve migrated a bunch of really big tables that are really old (insurance claims, prescriptions, and more), so there’s no way we could have another admin user that we haven’t created a commensurate WunderbarUser for, right?” Wrong! Your data can always have inconsistencies, but a simple SQL query (e.g. validate that all values of the column you’re migrating the foreign key to have a matching WunderbarUser) can save a lot of time and headaches.

2. When migrating foreign key constraints on tables with active reads in Postgres, ensure you break it into two steps. Migrate your foreign key with `{ validate: false }`

 def up
   remove_foreign_key :inventory_orders, to_table: :users, column: :created_by_id
   add_foreign_key :inventory_orders, :wunderbar_users, column: :created_by_id, validate: false
 
   validate_constraint
 end

Validate the named constraint of your foreign key separately

 def validate_constraint
   validate_constraint_statement = 'ALTER TABLE "inventory_orders" VALIDATE CONSTRAINT "fk_rails_abcd1234";'
   ActiveRecord::Base.connection.execute(validate_constraint_statement)
 end

3. When working with legacy tables, be mindful of legacy systems. Our Billing service used a very outdated golang ORM that panicked if a column specified by the `struct` in source no longer existed; this caused a late-night outage that made auto billing requests back up the next day.

4. Scoping projects is hard! This was a larger project than our team had ever scoped and delivered before. Once all the dust settled, this project took several months longer than our initial scoping estimates.This project was worth doing, but better estimates allow us to prioritize better. If we’d had a great scope of this immense project upfront, would we have chosen to do it first? Also, this was a tremendously difficult project to separate into material stages; all the benefit was really backloaded.

In the end, this was a very satisfying and important project to complete. We wouldn’t have been able to accomplish it without a lot of help from our colleagues on the Platform team, the Security team, and across many other functions atAlto. Very large projects that involve a lot of moving pieces and impact other teams are always scary — but we can’t let that fear prevent us from making the changes we know we need to do in order to be successful long-term.

The Engineering Team is hiring! Learn more about open positions here.

Face and fingerprint ID login is a convenient, seamless way to gain app access on a mobile device. Instead of typing in a lengthy, hard-to-remember username and password, many apps allow you login with just a quick scan of your face or fingerprint (also known as biometrics).

Considerations and Approaches for Implementing Biometric Login: Part 1

It's a desirable feature for both our end user and the Patients Team here at Alto — we want to make it as easy as possible for users to log in while also performing more frequent authentication checks. Improve the user experience and the security of our app? Sounds like a win-win.

As an engineer, implementing biometric login might seem easy, as mobile devices already capture, manage, and encrypt biometric data and expose APIs for app developers like myself to initiate a biometric scan. All I need to do is call that API and wait to hear if the scan is successful or not. What isn't as simple, though, is figuring out what to actually do with a successful biometric scan response. What does a successful scan mean, and how does that relate to the username and password credentials that users currently use to access our app?

This post walks through the decision points we encountered while implementing biometric login and how our healthcare privacy concerns influenced the final implementation approach.

Prior to implementing biometric login, the only way for users to access the Alto app was with email (username) and password. A valid email and password generates a session, which expires at some frequency. Once the session expires, the user must re-enter their email and password to regain access to the app.

From the beginning, we knew that biometrics would need to be built with our existing email and password session management in mind. This is made clear in the Apple developer docs: "Use biometrics as a supplement to something you’re already doing. Don’t depend on biometrics as your only authentication option."

Make it easier for users to login. Nobody likes typing in an email and password — especially on a mobile app. Our goal was to reduce the number of times a user must enter their email and password.

Enhance the security of our app using more frequent authentication checks. As a healthcare app that displays Personal Health Information (PHI), conducting more frequent authorization checks decreases the likelihood of PHI becoming exposed to an unauthorized third party.

Have the ability to revoke biometric access from a particular user. Similarly, we want to be extra careful to ensure that if a device is lost or stolen, we have a fallback plan to invalidate a user's session and protect the user’s PHI. For email and password initiated sessions, this happens when a user changes their password, as any change in login credentials will invalidate all active sessions for that user. We needed a similar contingency plan for biometric login.

There are several ways to use a mobile device's biometrics to authenticate a user, with varying degrees of security.

No server-side authentication. Simply integrate with the device's biometrics as an extra layer of authentication. If the biometric scan is successful, let the user proceed into the app.

Provides an extra check and gives your app a sense of modern polish

No server-side validation means that nothing is being validated against your system, so this is not a good substitute for account authentication. Therefore, even if you add this check, the user should still be prompted to re-enter their email and password at the same frequency as before.

Given this, this approach wouldn't help us reach our goal of reducing the number of times a user must enter their email and password.

This approach is a good fit if your application already has an existing login and session management system, and you want extra authentication checks throughout the user's session without modifying any other part of the system.

Tie biometrics to our existing email and password authentication. Use the user's biometrics to unlock an encrypted version of their email and password credentials. When a user sets up biometric login, store the user's login credentials within the device's keystore — the keystore will automatically encrypt the credentials. After a successful biometric scan, retrieve those credentials from the keystore and send them to your existing login API.

Still easy to implement, no backend changes needed

Biometric scan can be used in place of entering an email and password

Changing email and password credentials will revoke biometric access: if a user changes their credentials, their biometrics will access stale credentials and fail to login. (This is somewhat of a con as well — it provides a poor user experience, but it's an edge case that should happen infrequently.)

There is still only one way for a user to authenticate server-side, but now two ways to pass server-side authentication — essentially weakening your app's existing account security.

This approach effectively hands out internal login credentials to third party storage. While not a huge risk considering a device's secure storage is encrypted and trusted by most users, it’s not necessarily a best practice either.

This approach is a good fit if your application doesn't contain sensitive data, and your goal is to make it more convenient for a user to login by replacing email and password with a biometric scan.

Create a separate authentication mechanism for biometrics. Introduce a new authentication mechanism specifically for biometrics, resulting in two independent forms of server-side session authentication: email with password and biometrics. The implementation could look like generating a keypair or a shared secret to save and validate against the server whenever a user attempts to login with biometrics.

Biometrics is now tied to its own secure server-side authentication mechanism, which means it can be used independently of email/password (or even replace it, if you choose to).

Two layers of authentication adds security to the app. Not only does a user need a valid email/password session, they also need a valid biometric session.

It provides fine-grain control over a user's biometric session. You can invalidate a user's biometric session by invalidating the public key and can even invalidate a biometric session without impacting an email-and-password session if needed.

Requires building and maintaining a separate authentication mechanism

This approach is a good fit if your application contains sensitive data (e.g. PHI or financial information), and your goals are to make it both more convenient for a user to login by replacing email and password with a biometric scan while also strengthening the security of your account management system.

Because we are a healthcare company dealing with sensitive data, we chose this last path. It required greater engineering investment, but we agreed it was imperative that we maintain a secure system while introducing biometric login for users.

In part 2, we talk implementation details, including the library we used, code snippets, and questions to consider before you get started. Interested in learning more about engineering at Alto? Follow us on LinkedIn.

Residents of the Austin metro area can now choose Alto’s same-day doorstep delivery for their pharmacy needs. 

Hello Austin

Alto's new Austin-based pharmacy marks our third location in Texas.

Starting today, December 7th, residents of the Austin metro area can now choose Alto’s same-day doorstep delivery for their pharmacy needs. 

At Alto, we believe it’s our job to ensure you have your medications at the best price, on time and with the support you need. We bring pharmacy to you - no more waiting in line, making an extra trip, or finding out your prescription isn’t ready to be picked up after you’ve already arrived. Our free doorstep delivery means your medications come directly to you on the day and time you select, and most medications are available the same-day. Stay up to date on your courier’s progress with text alerts or in our mobile app. 

Starting a new medication or doing an injection for the first time? Message a pharmacist with your questions, even in the evenings and on weekends. And we’re a full service pharmacy - we stock all major brand, generic, over-the-counter and specialty medications, meaning your entire family’s pharmacy needs can be managed in the Alto app and coordinated into one delivery.

Courier delivery windows
Monday - Friday: 6 - 9 pm CT (7 - 10 pm CT for outlying areas)
Saturday - Sunday: 2 - 5 pm CT (3 - 6 pm CT for outlying areas)

Walk-in hours
Monday - Friday: 9 am – 7 pm CT
Saturday - Sunday: 8 am - 4:30 pm CT

Austin residents interested in using Alto’s services for their medication needs can ask their doctor’s office to send all prescriptions to Alto Pharmacy (via ePrescribe, phone or fax).

Have existing prescriptions at another pharmacy? Start a transfer online or give us a call at 1 (800) 874-5881, and we’ll handle the switch.

Need to pick up? Our pharmacy is located at 4175 Freidrich Lane, Suite 202.

General customer support hours are Monday - Friday 8 am - 11 pm CT and Saturday - Sunday 9 am - 8 pm CT. Patients can reach out to Alto via phone at 1 (800) 874-5881 or in the Alto app.

Founded in 2015, Alto is a patient-centric digital pharmacy based committed to the health and wellbeing of you and your family. We provide free same-day delivery to your door seven days a week for prescriptions, but, more importantly, offer cost transparency, personalized in-app and phone support, and real-time coordination with doctors and insurance companies to get you the care that you need. Alto is headquartered in San Francisco with offices in Denver and Dallas, and currently delivers across the greater Bay Area, Los Angeles, Orange County, San Diego, Seattle, Denver, Las Vegas, New York City, Houston, Dallas and Austin.

Editor’s Note: This post was originally published in December 2021 and has been updated for accuracy and completeness.

World AIDS Day, observed on December 1st every year, is an important reminder that progress in the global fight against AIDS requires action and awareness from each individual around the world.

Take Action for World AIDS Day 2021

World AIDS Day, observed on December 1st every year since 1988, is an important reminder that progress in the global fight against AIDS requires action and awareness from each individual around the world.

AIDS (acquired immunodeficiency syndrome) was heavily stigmatized from the beginning of the epidemic in the 1980s. Four years passed between the first cases of AIDS in the U.S. in 1981 and the Reagan administration’s first public mention of the disease. There were many misconceptions about how HIV (human immunodeficiency virus) — the virus that causes AIDS — can be transmitted and who is at risk of contracting it.

The stigma and lack of information about transmission and prevention led to many preventable cases of HIV/AIDS in the U.S. At the peak of the epidemic in 1995, complications from the disease were the leading cause of death for adults ages 25-44, and to date, more than 700,000 people in the U.S. have died from an HIV-related illness.

The HIV and AIDS landscape looks dramatically different today than it did back when World AIDS Day was first established. With greater awareness of HIV and AIDS, and more government funding of research, new HIV infections in the U.S. decreased by 73% between 1984 and 2019. Still, the fight to end AIDS isn’t over, with more than 1.2 million people living with HIV in the U.S.

In honor of World AIDS Day 2021, take a look at what has already been accomplished in the fight against AIDS and learn about what is needed next.

There were 34,800 new HIV infections in 2019

13% of those living with HIV don’t know it

57% of those living with HIV are virally suppressed (meaning they are not at risk of transmitting the virus to others)

Milestones in the history of HIV and AIDS

AIDS first emerged in the U.S. in 1981, but researchers did not learn that HIV caused AIDS until three years later in 1984. The history of HIV medication dates back to 1986, when clinical trials for azidothymidineor (AZT), the first antiretroviral HIV/AIDS medication, began. AZT was approved to treat HIV a year later.

Highly active antiretroviral therapy, often referred to as antiretroviral therapy (ART), became the frontline treatment for HIV in 1997. ART is a combination of medications that lower your viral load, which is the amount of HIV in your bloodstream. When taken every day as prescribed, these medications can help individuals with HIV maintain an undetectable viral load, virtually eliminating their risk of transmitting the virus to others.

The U.S. Food and Drug Administration (FDA) first approved a PrEP medication in 2012. PrEP, or pre-exposure prophylaxis, can lower the risk of sexual transmission of HIV by 99% when taken daily and reduces the risk of getting HIV from intravenous drug use by about 74%.

With these breakthroughs in HIV treatment and prevention therapies, the U.S. government recently announced a goal to reduce the number of new HIV infections by 75% by 2025 and at least 90% by 2030, preventing an estimated 250,000 additional cases of HIV.

Next steps in the fight against HIV and AIDS

Despite the progress that has been made in the fight against HIV and AIDS, prevention, care, and treatment remain inaccessible for many individuals at risk of contracting HIV — both in the U.S. and around the world. The theme for World AIDS Day 2021 is Ending the HIV Epidemic: Equitable Access, Everyone’s Voice, in recognition of how health inequities contribute to the epidemic.

In the U.S., racial discrimination and deeper inequities in healthcare have contributed to HIV’s disproportionate impact upon people of color. Black and Latinx individuals — particularly gay and bisexual men — are among the groups disproportionately affected by HIV. A variety of factors contribute to these disparities, including income inequality, unequal access to healthcare, and lower use of HIV prevention and treatment services. According to 2016 CDC data, white individuals accounted for 69% of PrEP use, while Latinx and Black individuals accounted for 13% and 11%, respectively.

Fortunately, HIV prevention medication continues to become more accessible, with generic medication options and expanded health insurance coverage of PrEP. And legislation in a handful of states, including California and Colorado, allows pharmacists to prescribe PrEP. There are also a number of organizations working hard to make HIV services more accessible to communities of color, like NMAC and Black AIDS Institute.

Getting an HIV test is one of the most important things you can do for World AIDS Day. Not only will learning your HIV status give you the information you need to take control of your health, it will also help combat the stigma surrounding HIV and AIDS. Each person who makes use of testing and prevention services — and each person who speaks openly about HIV and AIDS, without perpetuating fear or stigma — brings us closer to a future without AIDS.

Search for a free and confidential HIV testing site near you.

View the CDC’s HIV stigma language guide to learn the power of the words you use when discussing HIV and AIDS.

Get support navigating HIV treatment and prevention medication

At Alto, we’re committed to doing our part to make HIV treatment and prevention services as accessible as possible. Our extensive library of HIV-focused content covers the information you need to make informed decisions about your health. And if you take PrEP or ART, our team will coordinate with your doctor’s office and your insurance provider to ensure that you’re receiving the best medication option for your health needs at the lowest price.

Blog

An Introduction to Skin Health

The Right Way to Use a Metered Dose Inhaler

Managing Your Medications While Traveling

Tackling Technical Debt and Improving Security: How Alto Untangled an Overloaded User Model

Considerations and Approaches for Implementing Biometric Login: Part 1

Hello Austin, We're Alto Pharmacy!

How to Take Action for World AIDS Day 2021

How to Keep Your Heart Healthy During the Holidays

How to Manage Asthma at Night

How Sleep Affects Heart Health & Tips for Better Sleep

How to Prepare for Cold and Flu Season

What to Know About the Heart and Gut Health Connection

Switch to a better pharmacy.