Safety is a chain, not a temperature
The safety architecture of donor human milk banking is the focus here: how a bank uses several controls to move a changing biological material from a screened donor to a vulnerable recipient. The useful judgment is to match each safety claim to the control that can support it. Screening, hygienic collection, cold storage, treatment, testing and traceability do different jobs; none should be treated as a substitute for all the others.
This matters because heat treatment is the most visible intervention, but it is only one point in the pathway. A donor may contribute a health or exposure risk that screening is designed to detect. Milk may be contaminated or allowed to warm before it reaches the pasteurizer. A treatment may reduce many microbes but leave some hazards outside its reach. A batch may pass treatment and still need testing before release. Safety is produced by the relationship among these controls, not by a temperature in isolation.
Upstream controls decide what can enter the chain
The first boundary is the donor. WHO recommends that potential donors complete a risk questionnaire and receive serological screening, including exclusion of people who test positive for HIV or human T-lymphotropic virus 1. The questionnaire also addresses recreational drugs, alcohol and medicines known to pass into milk and to be contraindicated during breastfeeding. These checks answer a question that pasteurization cannot answer by itself: is this contribution eligible to enter a system serving infants who may be especially vulnerable to infection or harmful substances?
Screening works before the milk becomes a batch. It can identify a risk associated with the donor’s health, exposure or behavior, and it can prompt a decision not to accept the contribution. Heat treatment, by contrast, acts on the milk after donation and is aimed mainly at reducing microbial hazards under specified conditions. It cannot retroactively make every donor decision irrelevant, and it does not make all substances safe simply because the milk has been heated. That is why WHO recommends screening before donation and at a designated frequency during the donation period.
Screening is also a feedback relationship, not a single gate that closes forever. Donors are asked to report changes in health or behavior that could affect milk safety. A later change can alter the eligibility of milk that would previously have been acceptable, which is why the bank needs communication and repeat checks rather than relying only on the first questionnaire. At the same time, the decision has to be proportionate. WHO prioritized screening questions and tests that address important transmission or exposure risks, while warning that excessive screening can reduce the donor pool and raise the cost of milk without necessarily improving access.
The boundary also has a human consequence. A screening decision affects not only a recipient but the donor’s relationship with their own infant. WHO recommends that people who do not qualify to donate should be encouraged to continue breastfeeding their own infant unless there is a contraindication. Restrictions should not create the impression that milk from an ineligible donor is unsafe or nutritionally incomplete for their own child. The same screening system that protects recipients can cause harm if it is communicated as a judgment about the donor’s worth or the value of their milk in every context.
The next upstream control is how milk is expressed and handled. WHO recommends education on hand hygiene and on cleaning and disinfecting equipment or supplies. Manual expression, manual pumps and electric pumps can all be acceptable; the point is not to impose one device but to support safe and acceptable practice. The available evidence did not show that one expression method reliably determines contamination or infant outcomes. A bank therefore owns the safety conditions around expression—education, equipment and reporting of relevant changes in health or behavior—without pretending that a particular pump guarantees a superior product.
Containers are an interface between the donor’s environment and the bank’s process. WHO recommends clean, food-grade containers that seal effectively and resist breakage for storage and transport. Containers used in the bank should be easy to clean, disinfect and label, with an effective closure and approved food-grade quality. These requirements may sound ordinary, but an open, damaged or poorly identified container can create three different problems: contamination, loss of milk during transport, or a failure to know which batch a sample belongs to. A container is not just a vessel; it carries the product across a boundary where ownership and information can be lost.
Time and temperature create another boundary. WHO recommends that milk for donation be refrigerated or frozen as soon as possible and specifies limits for raw and pasteurized milk under monitored storage conditions. The reason is biological: bacterial load can increase during room-temperature storage, especially in warm environments, while longer or poorly controlled storage can affect some nutrients and the reliability of the product. Cold storage does not freeze the milk’s biology in a perfect state, but it slows changes enough to keep later controls meaningful.
The cold chain also has an access dimension. A bank needs dependable refrigeration and freezer conditions from receipt through delivery, including transport, and it needs regular temperature records. In a setting with unreliable electricity, backup power or other infrastructure may be necessary. If a donor cannot maintain the recommended conditions, or if the bank cannot receive milk promptly, a contribution may be discarded even though the donor acted in good faith. A cold-chain failure is therefore both a safety event and a loss of scarce supply.
Operational limits should not be confused with direct proof of benefit. WHO’s evidence synthesis supports the importance of controlled storage for bacterial stability and preservation of many nutrients, but it says evidence connecting storage temperatures to infant outcomes is inconclusive. The bank still needs the control because an increase in bacterial load or loss of product can create an immediate safety and access problem. The absence of a clear infant-outcome estimate does not mean storage is unimportant; it means the justification is partly mechanistic and operational rather than a completed clinical comparison.
These upstream controls are connected but not interchangeable. Screening can reduce a donor-related hazard but cannot prevent bacterial growth during a long warm delay. Hygiene and a suitable container can reduce contamination at collection but cannot establish that a donor is eligible. Refrigeration can slow growth but cannot replace the later treatment or testing rules. The bank’s responsibility is to keep each transition within the conditions required by the next one.
Downstream controls decide whether a batch can be released
Once contributions arrive, the bank must decide how to form and identify a batch. Pooling milk from several donors can improve nutritional consistency by reducing variation in protein and fat, and it may reduce variation in IgA activity. But pooling also changes the size of the failure. If one contribution introduces contamination, the whole pooled batch may need to be discarded. The bank gains a more consistent product while accepting that more milk can be placed at risk together.
The benefit is therefore a property of the product’s consistency, not a proven guarantee of better infant health. WHO reports that the available studies did not address infant outcomes for multi-donor versus single-donor milk. That missing comparison matters: a bank can reasonably say that pooling reduces some measured variation, but it should not silently convert that observation into a claim that pooled milk produces superior clinical outcomes.
That trade-off makes traceability essential. WHO recommends systems that can track donor milk from donor to recipient and trace it back from recipient to donor in the event of an adverse event. A digital system may make records easier to retrieve and scale, but a consistently maintained paper system can also be acceptable where digital infrastructure is not feasible. The point is not the sophistication of the database. The point is preserving the identity and movement of the milk well enough to investigate a failure and limit its consequences.
Treatment is the next control, not the conclusion of the process. WHO recommends Holder pasteurization or high-temperature short-time treatment for donor milk from screened healthy women to reduce or eliminate viral and bacterial pathogens. In some settings, heat may be avoided when each container of raw milk is tested against locally acceptable safety limits. Retort treatment is not recommended. These choices show that a bank is balancing the benefits of microbial reduction against the preservation of biological properties and the resources required to operate the method.
Post-pasteurization testing provides a separate check on the treated batch. WHO recommends testing microbial content after pasteurization, with at least one representative sample per batch. The purpose is not to prove that every molecule in the milk remains unchanged. It is to verify that processing was successful and that microbial content has not exceeded an acceptable threshold at the time of testing. The standards propose discarding pasteurized milk at a threshold of ≥10 colony-forming units per milliliter, while noting the practical context in which that threshold can be assessed.
Nutritional testing asks a different question and is not currently recommended by WHO. The standards state that available nutritional testing methods are not sufficiently reliable and are infeasible in many donor-milk settings, while evidence that such testing improves infant outcomes is absent. This is an important distinction. A measurement can be desirable in principle but still be a poor routine control if it is expensive, unreliable or disconnected from a decision that improves care. A bank does not become more rigorous by measuring everything; it becomes more rigorous by using measurements that answer a defined safety question.
A representative microbial test is therefore a release control, not a complete description of the batch. If the result is unacceptable, the bank has to hold or discard the affected milk and use its records to ask where the failure arose. If the result is acceptable, the bank still has to preserve the cold chain and the product identity through delivery. The result supports a bounded decision at one point in time; it does not certify that every earlier transition was perfect or that the milk’s biological properties are unchanged.
The sequence below makes the ownership and decision points visible.
The diagram contains an easily missed asymmetry. The laboratory result returns to the bank, which owns the release decision; the treatment step does not release its own output. If the result is unacceptable, the batch does not become safe merely because it has already been heated. It is held or discarded, and the records preserve the link needed for investigation. If it is released, the record continues forward to the recipient and remains traceable backward to the donor.
This separation of duties also explains why the standards do not frame treatment as sterilization. WHO reports that heat treatment can reduce microbial loads to below detectable levels in many studies, but viable cells may remain in some cases and Bacillus spores are not destroyed by heat treatment. The reviewed evidence also indicates that heat below the Holder condition did not consistently inactivate viruses. Post-treatment testing and careful storage are still meaningful because the process has defined limits and because contamination can occur at more than one point.
Every added control has a supply cost. More stringent or poorly targeted testing can increase discard. Pooling can make a failed batch larger. Cold-chain requirements can exclude donations in places without reliable refrigeration. Enhanced screening for raw milk can be expensive. Yet removing controls has its own cost: more contamination risk, less confidence among recipients and health-care workers, and less ability to identify the source of an adverse event. The goal is not the maximum number of checks regardless of consequence. It is a defensible combination of controls that protects recipients without making safe donor milk inaccessible.
The evidence for direct infant outcomes remains limited, so this architecture should not be presented as a guarantee of zero harm. WHO notes that much of the evidence behind its recommendations is low or very low certainty. Still, the structure has a clear logic. Donor screening limits source-related risk. Education and containers reduce avoidable contamination at collection. Cold-chain control limits growth during storage. Pooling manages variation but changes batch exposure. Treatment reduces many microbial hazards while potentially changing milk biology. Post-treatment testing checks the batch, and traceability makes failures actionable.
That is why safety in donor human milk banking cannot be reduced to a temperature. Temperature is one control with a particular purpose and particular limits. The chain around it determines what enters the process, what survives it, whether the result can be released, and whether the system can learn from failure. Once those dimensions are separated, the next question is unavoidable: if a treatment improves microbial safety but changes biological properties, which meaning of “better” should guide the choice?