Here's how to view stream properties in SQL.  Alternatively you can use %CONTAINS to search the stream.

Another way would be writing an sql procedure that gets stream, converts it to object  and checks if it has the token. Would be slow though. Maybe do a simple [ check first and then pass only those rows that have the token into sql procedure?

Can you parse the stream when you receive the message?

You can set PasswordValidationRoutine in  the Security.System class. When a user is created in the Cache security database, or a user changes their password, the specified routine is called to validate the password. A tag reference may also be included in the property. The routine should be provided by the user, and must exist in the %SYS namespace (it may be mapped to a different database however.) The routine will take 2 parameters, a Username and new password, and should return a %Status code of $$$OK for successful password validation, or an error code formatted into a %Status variable. The username passed into the function will be in all lowercase, and will contain the domain name if multiple domains are enabled for the system.
 

Second line should be:

Set status=context.ReturnedIds.SetAt(callresponse.PatientLookupResult.Patients.GetAt(1).IDs.GetAt(1).ID, 1)

You need to modify your BP definition to something like this:

<assign property="context.ReturnedIds" value="callresponse.PatientLookupResult.Patients.GetAt(1).IDs.GetAt(1).ID" action="set" key="1"/>

To copy all IDs for all patients you'll need to iterate over results.