HTST Pasteurization: How It Works and What the PMO Requires

HTST pasteurization heats every particle of milk to at least 161°F and holds it there for at least 15 seconds, and a Grade "A" plant has to prove that happened on every run, with a chart, a seal and a signature. This guide covers both halves of the job: how the process and the equipment work, and the daily checks, records and tests the Pasteurized Milk Ordinance (PMO) expects. The stakes are well documented. A study of 2009 to 2014 outbreaks in CDC's Emerging Infectious Diseases estimated that unpasteurized dairy caused 840 times more illnesses than pasteurized dairy.

Figures are from the Grade "A" Pasteurized Milk Ordinance, 2025 Revision, listed on FDA's NCIMS model documents page. Check which revision your state has adopted. This is general information, not legal advice: your state's PMO and your Regulatory Agency control.

What Is HTST Pasteurization?

HTST (high-temperature, short-time) pasteurization is a continuous-flow process that heats every particle of milk to at least 161°F (72°C), holds it for at least 15 seconds in a holding tube, then cools it rapidly. The PMO's definition of pasteurization (Section 1, SS) requires heating "every particle of milk or milk product, in properly designed and operated equipment" to a listed temperature, held "continuously at or above that temperature for at least the corresponding specified time."

HTST, flash pasteurization and "high-temperature short-time": same process

"Flash pasteurization" is the name the juice and beverage industries use for the same short, continuous heat treatment. The rules are different, as the juice and beverages section below explains.

Is HTST sterilization?

No. HTST kills vegetative pathogens but not bacterial spores, so the product still has to be cooled and kept at 45°F (7°C) or less (PMO Item 17p and Section 7, Table 1).

HTST Time and Temperature Requirements (the PMO Table)

These are the legal minimums from PMO Section 1, definition SS. The federal rule for milk in interstate commerce, 21 CFR 1240.61, carries the same table.

*The PMO footnote: "If the fat content of the milk product is ten percent (10%) or greater, or a total-solids of 18% or greater, or if it contains added sweeteners, the specified temperature shall be increased by 3°C (5°F)." That makes the HTST minimum 166°F for 15 seconds for cream and for sweetened flavored milks. The federal tables in 21 CFR 1240.61 and 21 CFR 131.3 add the same 5°F for fat and sweeteners, but the 18% total-solids trigger is in the PMO only.

Eggnog has its own minimums: 155°F for 30 minutes in a vat, or 175°F for 25 seconds or 180°F for 15 seconds by HTST. Ultra-pasteurized (UP) product must reach at least 280°F (138°C) for at least 2 seconds, not the "4 to 5 seconds" some sources quote (PMO definition III; 21 CFR 131.3(c)).

HTST Compliance at a Glance

"Regulatory Agency" means your state milk regulator.

How an HTST Pasteurizer Works, Component by Component

Raw milk flows from the constant-level (balance) tank through the regenerator's raw side, the timing pump and the heating section into the holding tube. At the tube's outlet, the recorder-controller reads the temperature and the flow diversion device (FDD) sends the milk forward or back. Forward-flow milk heats incoming raw milk in the regenerator, then the cooler brings it to 45°F or less.

Magnetic flow meter-based timing systems

Some systems control holding time with a magnetic flow meter instead of a positive-displacement pump. Their flow-rate charts must continuously record the flow rate and the status of the high-flow and low-flow or loss-of-signal alarms (Item 16p.(D)1.c).

The Flow Diversion Device: What Happens When Temperature Drops

When the temperature at the recorder-controller sensor falls below the cut-out point, the FDD moves to diverted flow. Sub-temperature milk goes back through the divert line to the constant-level tank to be pasteurized again. It does not go to a separate reject tank. The leak-escape on the forward-flow side sends any leakage outside, or to the constant-level tank through its own line with a sight glass (Item 16p.(B)2.b(3)).

Two rules catch operators out:

• CIP mode: when the FDD is switched to "CIP," it moves to divert and stays there for at least 10 minutes regardless of temperature, and an HTST booster pump can't run during that time (Item 16p.(B)2.b(12)). See our clean-in-place (CIP) guide for the cycle itself.
• Power loss: failure of the primary motivating power must divert flow automatically (Item 16p.(B)2.b(5)).

The scenario that matters most is product that went forward below temperature through a stuck valve, a pulled sensor or a broken seal. Typical practice is to treat it as not pasteurized: hold it, notify your Regulatory Agency as your procedures require, record the deviation and disposition, and find the cause before restarting. Your corrective action plan should name who does each step before it ever happens.

HTST Records: What the Chart Must Show and Who Signs It

Under PMO Item 16p.(D)1, every pasteurization chart must be reviewed, dated and signed or initialed, kept onsite for the previous 3 months or since the last inspection (whichever is longer), and retained for 2 years. Offsite storage is allowed if the chart can be produced onsite within 24 hours, and "overlapping of recorded data shall be a violation."

For HTST and HHST systems, the chart must show:

• the date, the plant name or code, and the recorder number or location if there is more than one
• a continuous record of product temperature
• the indicating thermometer reading, recorded again immediately after a chart change
• the time the FDD was in forward flow
• the daily cut-in and cut-out temperatures (HTST), initialed quarterly by the Regulatory Agency
• the recorder's time accuracy, checked quarterly by the Regulatory Agency
• the amount and name of each product run
• unusual occurrences, and the operator's signature or initials

The daily chart review, line by line

The PMO sets the chart's contents, and the review method is yours. A typical check before signing:

1. The chart covers the full run with no gaps or overlapping data.
2. There was no forward flow below the cut-out temperature.
3. The day's cut-in and cut-out temperatures are entered.
4. Indicating readings are entered at start-up and after each chart change, and the recorder never reads above them.
5. Product names, amounts, unusual occurrences and operator initials are present.
6. The seals were intact, or a broken seal was reported.
7. The reviewer signs and dates the chart.

Chart review is a verification activity, so it belongs in your HACCP verification schedule alongside the equipment tests.

Electronic pasteurization records

Item 16p.(D)1.d allows electronic collection, storage and reporting of pasteurization records, "with or without hard copy printouts," when the system meets Appendix H, Section V. That section governs electronic systems that generate the pasteurization record in place of a paper chart. A forms platform that records the human checks around the chart doesn't replace it.

Your recorder chart stays the legal record of the process. Allera handles the human checks around it: operators complete the daily start-up check in a Digital Form (cut-in and cut-out temperatures, the recorder-versus-indicating reading, seals intact) and sign it with a Signature field, even when Wi-Fi drops on the floor. The chart review routes to the approvers named on the form, and a recurring daily task shows whether each review was Completed On Time or Completed Late. See how Allera handles daily QA checks.

Seals, Broken Seals and Equipment Tests

Seals exist so nobody can shorten the hold or lower the cut-out without detection. The Regulatory Agency seals the recorder-controller setting and the timing pump's speed setting after testing, and neither seal may be removed "without immediately notifying the Regulatory Agency" (Item 16p.(B)2.c(1) and f(2)).

PMO Table 4 lists which Appendix I tests apply to HTST systems:

• thermometer and recorder accuracy, and recorder against indicating (Tests 1 to 4)
• FDD leakage, movement, assembly, manual diversion, response time and time delays (Tests 5.1 to 5.9)
• thermometric response (Tests 7 and 8; the recorder-controller must respond in five seconds or less)
• regenerator pressure controls and booster pump inter-wiring (Test 9)
• cut-in and cut-out temperatures (Test 10.1), holding time (Test 11), and electromagnetic interference for electronic controls (Test 15)

For HTST, Tests 12 and 14 apply only where the FDD sits downstream of the regenerator or cooler (Test 14 also needs direct steam injection). Test 6 is vat-only and Test 13 is HHST-only.

The Regulatory Agency runs these tests at installation, at least once every 3 months, after any alteration or replacement that could affect the device, and whenever a regulatory seal has been broken. Holding-time tests run at least once every 6 months (Item 16p.(D)2). Test results are recorded on forms like those in Appendix M, and you keep your copy for 2 years. Keep the indicating thermometer's calibration history in your thermometer calibration log, since the recorder is judged against it.

When a seal breaks, a trained plant employee who holds Regulatory Agency authorization, and has demonstrated the tests in front of a regulatory official within the past year, may test and temporarily seal the equipment on an emergency basis. That person must notify the Regulatory Agency immediately, get permission for each incident, and report the controls affected, the cause, the repairs, the test results, and the identity and volume of product processed under the temporary seal. The Regulatory Agency must retest and reseal within 10 working days, and Grade "A" product can't be processed past that point without it. If the retest finds the equipment out of compliance, the Regulatory Agency may recall product processed in that period (Item 16p.(D)2.a to h).

Under the NCIMS voluntary HACCP program

In plants with HACCP plans regulated under the NCIMS voluntary HACCP program, industry personnel acceptable to the Regulatory Agency may test and seal the equipment. Industry is responsible for every required test, and the Regulatory Agency must physically supervise the tests at least every 6 months. Our HARPC vs HACCP guide explains how HACCP and preventive controls relate.

General information only: your state's adopted PMO and your Regulatory Agency govern seals and testing.

Verifying Pasteurization Worked: Phosphatase, Cooling and Post-Pasteurization Contamination

Alkaline phosphatase is the efficacy test: pasteurized product must test under 350 milliunits/L by an approved electronic procedure (Section 7, Table 1). The Regulatory Agency collects at least 4 samples of each product in any 6 consecutive months. When a phosphatase test is positive, the cause must be found. If it was improper pasteurization, it must be corrected, and the product involved "shall not be offered for sale" (Section 6).

Pasteurized product must then be cooled to 45°F or less before filling (Item 17p), and a temperature log template for cold storage is how you show it stayed there.

The residual risk is post-pasteurization contamination. Pasteurization does nothing for product that picks up Listeria from a filler, cooler or drain after the FDD, which is why your environmental monitoring program matters as much as the pasteurizer.

HTST vs Vat (LTLT) vs HHST vs UHT

Shelf-stable "UHT" milk depends on aseptic packaging, and our guide to retort processing covers the shelf-stable thermal processes and their records.

Flash Pasteurization Beyond Dairy: Juice, Beer and Beverages

When flash pasteurization is applied to juice, the PMO doesn't apply. Juice processors work under juice HACCP, 21 CFR Part 120, and 21 CFR 120.24 requires control measures that "consistently produce, at a minimum, a 5 log" reduction in the pertinent microorganism.

You have to validate that the process achieves it, and FDA's Juice HACCP Hazards and Controls Guidance explains how. Facilities that comply with Part 120 are exempt from Part 117 subparts C and G (preventive controls and supply-chain program) for those activities (21 CFR 117.5(c)).

For beer and other beverages outside the juice rule, flash pasteurization is usually a shelf-life and stability step, and your own hazard analysis decides how you control it.

Where HTST Fits in HACCP and FSMA

Pasteurization is the textbook critical control point, and every HACCP element maps onto the PMO:

• Critical limit: the PMO time and temperature for your product
• Monitoring: the recorder-controller and FDD, plus the operator's daily checks
• Corrective action: automatic diversion, plus handling for anything that went forward
• Verification: chart review, the quarterly tests and phosphatase results

That makes it one of the clearest critical control point examples for a HACCP plan, and a CCP rather than an operational prerequisite program (see our OPRP vs CCP guide).

PMO Appendix T: the PMO is part of your food safety plan

Appendix T says the PMO, its appendices and your plant-specific procedures "shall constitute a milk plant's food safety plan as required by 21 CFR 117.126," to the extent those procedures address all the hazards you identified. The food safety plan must be written, and prepared or overseen by one or more PCQIs (see our PCQI training overview). It must include:

• a written Recall Plan (our recall plan template covers the structure)
• a written hazard analysis
• preventive controls, a supply-chain program, and monitoring, corrective action and verification procedures for hazards the PMO doesn't address

The owner or operator signs and dates the plan on completion and on any modification. A PCQI performs or oversees a reanalysis at least every 3 years and after significant changes. SQF, BRCGS and FSSC 22000 auditors at a Grade "A" plant will typically ask for the same PMO records your state inspector reviews.

When a value someone enters breaks a rule on the form, such as a recorder reading higher than the indicating thermometer, the submission is flagged as Failed and a Corrective Action task is created automatically. Equipment test records from your Regulatory Agency, broken-seal notices, the HTST flow schematic and your Appendix T food safety plan can live in Document Control, with approval workflows, Scheduled Review and an exportable Audit Trail. See how Allera keeps HTST records audit ready.

Who Can Operate an HTST Pasteurizer: Training and Licensing

Operator licensing varies by state. Oregon, for example, licenses HTST pasteurizer operators (the license also covers HHST and UHT equipment), and applicants need at least two months (60 sessions) of practical experience plus written and practical exams, according to the Oregon Department of Agriculture's HTST study manual.

Cornell's three-day HTST Pasteurizer Workshop covers system design, the regulatory tests and record-keeping, and meets the training requirement for New York's HTST Broken Seal Program. Whatever your state requires, keep each operator's license and training records where you can pull them up for an inspector.

Your pasteurizer proves the temperature, and your records prove the pasteurizer. If your start-up checks, chart sign-offs and broken-seal notices still live on clipboards and in binders, keeping track of them before an inspection is a headache you don't need. See how Allera keeps HTST checks and sign-offs audit ready.