Patients should not be able to get your DEA number off the wall and then pretend to be a staff member and call themselves in a Rx. Maybe redact the number and post the certificate as a compromise.