Fortunately no specific certifications are required. So it was mostly writing policies and ensuring best practices that met HIPAA controls in the beginning.