Most of us know it is unwise to use the same unwashed utensils on raw then cooked chicken or eat raw cookie dough (although we may cheerfully ignore the latter suggestion) because of the salmonella risk, but we aren't used to thinking of candy and nuts as potential pathogen sources. Yet chocolate can indeed pose a health risk due to contamination by the stomach-churning, usually nonfatal pathogen.

The last salmonella outbreak traced to chocolate was in 2006 in the U.K., but there have been two outbreaks due to peanut butter in the U.S. in the past four years. In both cases customers around the country suffered, and a few died. Even though the U.S. food supply is in general very safe, its vast distribution can mean that a large number of people in a wide geographic area can be afflicted by one bad batch of food, making consumers fearful.

Salmonella contamination in food generally originates in animals, albeit indirectly through contact with contaminated water or their feces. "[Cacao beans] are grown outside; they're taken out of their shells and left outside, covered by banana leaves. There are animals scurrying over them. It's a beautiful process, but it's open to the elements," said Laura Shumow, member of the National Confectioners Association's Chocolate Council, at a lecture on chocolate safety at the National Chocolate Show in Chicago in November. "Birds—they happen; animals—they happen; salmonella—it happens."

Before the 2008–09 peanut butter incident, which sickened hundreds of consumers in at least 43 states, most people thought dry ingredients such as nuts and chocolate bars were safe because salmonella likes wet conditions. "We learned something," Shumow said. "What we learned is that fat protects salmonella, and salmonella can live for a very long time in low-moisture products." High-temperature roasting is used to kill salmonella on the beans themselves. Dry roasting takes about an hour, but steam can be used to speed up the process significantly. Most chocolate manufacturers would choose to roast their beans irrespective of the safety benefit, for the same reasons that coffee manufacturers do: it removes bitterness and develops complex flavors. But Shumow noted that raw cacao products have become more popular recently. These are often marketed as organic and natural, but that doesn't necessarily mean they will be free from pathogens. Earlier this year one brand recalled its raw cacao nibs after internal testing showed that they were contaminated with Escherichia coli.

Even when beans are roasted, salmonella can still make its way into the product. It can happen in two ways: either via water or cross-contamination with raw beans. A leaky roof is thought to have been responsible for one of the peanut butter salmonella outbreaks. Shumow cautions that even if water itself is not contaminated, if introduced by accident, it can create a hospitable breeding ground for any latent salmonella in the product, increasing the risk. And beans that have not been roasted can transfer salmonella to candy during production. In order to minimize this risk, manufacturers should keep raw and finished products separate throughout the entire process.

Shumow said manufacturers who purchase roasted cacao beans or nibs rather than roasting them in-house should ask their suppliers what systems they use to kill microbes. They should also keep track of exactly whose ingredients go into each product as thoroughly as possible to aid in traceability in case of problems. This is also important for one of the other health risks involved with chocolate: allergens. Whereas allergenic agents are not inherently dangerous, they should always be labeled to inform and protect consumers with allergies.

Heavy metals are one other possible contaminant in chocolate, although they are rarer than salmonella. These elements, such as lead, can make their way into cacao beans from the ground, especially in regions with volcanic soil. That fancy single-origin dark chocolate bar might be more prone to contamination than a Hershey's kiss. Luckily children, who are more susceptible to heavy metal poisoning than are adults, generally don't have a taste for dark chocolate. Shumow said that local health authorities sometimes sample products already on the shelves to test for heavy metals, particularly lead, and that occasionally products are recalled for that reason, but it is not a big problem overall.

The U.S. Food and Drug Administration's Food Safety Modernization Act, signed into law in 2011, was a response in part to the 2008–09 peanut butter recall. As all of the new regulations are implemented, manufacturers throughout the food industry will need to implement systems called HAACP (Hazard Analysis and Critical Control Points) to manage risks associated with all portions of the food manufacturing process—from raw material production to distribution. Companies will also have to make sure any imported products—which includes almost all cacao beans—comply with the new standards as well. Most chocolate manufacturers, especially the large ones, already have safety systems that will comply with the new regulations, and Shumow said that firms are generally supportive of safety regulations because recalls and outbreaks usually depress sales of the type of food across the board, not just the tainted brands from implicated companies. "I think the industry's perspective on it is, 'I think the FDA should be a little more up to speed,'" she said.

Chocolate carries some inherent risks, but candy manufacturers have processes in place to minimize the chance of a salmonella outbreak. This holiday season, your cookie dough, which probably involves raw eggs and invites lots of spoon licking, is more likely than your chocolate is to make you sick.