some ideas...

use password fields, the entered patient id will show up as '*' and they can't cut and paste from one field to the other (but they could cut from another application and paste into both...).

if your patient id is fixed length, (say N characters) then use N seperate input fields and use some javascript to automatically move the focus to the next field after a key is pressed. don't know how cut and paste would work with this but hopefully a key-press is an event and a cut and paste is also an event so if you only accept one character per event cut and paste won't work...

or along the same line, in just plain text entry fields, have event triggered javascript that adds a non-display character (or even a space) after every keystroke, if they cut and paste then the second textbox will have the extra characters and you can throw an error.