I have unregistered users on a site, I want them to be able to enter their name and date of birth (DoB) and see if they are in a database. 

The act of being present in the database is somewhat sensitive information. How can I reduce the risk of curious third parties from looking up other peoples' information?

I was thinking an additional 2FA identifier such as an email address or phone number could be used in the following steps: 

1. Check that the user controls the email/phone with an email/SMS verification code
2. Match in the database on NAME+DOB+EMAIL/PHONE

Unfortunately, the email and phone information is only partially populated in the database, meaning the lookup will return many more false negatives than matching only on name and DoB. 

Is there any better solution to this problem?