Multi-Region Disaster Recovery Architecture for a Healthcare Data Platform

Key Results

  • 15-Minute RTO
  • 30-Second RPO
  • NHS Contract Secured
  • Validated DR Runbook

Have a similar project?

Let us help you build scalable solutions.

Talk to an Expert →

Project Background

A health data analytics company had won a conditional NHS contract that required them to demonstrate an audited disaster recovery capability with an RTO of 15 minutes and an RPO of 30 seconds. Their existing infrastructure ran entirely in a single AWS region with no DR plan, no tested backups, and an undocumented database architecture.

The Challenge

We had 10 weeks to design, build, document, and conduct a witnessed failover test before the NHS audit. The system handled sensitive patient-adjacent data subject to DSP Toolkit requirements, which imposed strict controls on where data could reside and who could access it during a DR event. The existing application had not been designed with multi-region in mind.

What We Delivered

  • Designed an active-passive architecture across eu-west-1 (primary) and eu-west-2 (DR) with automated health checks controlling Route 53 failover
  • Migrated the database layer to Amazon Aurora Global Database with a sub-second replication lag and one-click regional promotion
  • Deployed the full application stack to the DR region in a warm-standby state using Terraform, with ECS services scaled to zero but ready to activate in under 5 minutes
  • Built an automated DR orchestration Lambda that handles DNS cutover, ECS scale-up, secret replication verification, and Slack notifications in the correct sequence
  • Created a DR runbook with step-by-step procedures, decision trees for partial failures, and documented rollback steps — reviewed and approved by the NHS audit team
  • Conducted three full failover drills, achieving a consistent RTO of 11 minutes and RPO of 18 seconds in final testing

Technical Stack

DNS Failover: Route 53 health checks · Database: Amazon Aurora Global Database · Compute: ECS Fargate warm standby · Orchestration: AWS Lambda · IaC: Terraform · Secrets: AWS Secrets Manager cross-region replication

Outcomes

The NHS audit passed first time. The contract — worth £800k over three years — was signed within two weeks of the final DR test. The client now runs quarterly failover drills automatically via a scheduled Lambda, producing an audit-ready report each time. RTO in production testing consistently comes in under 12 minutes.