I suspect they request your credit report with your personal info (if you are a business requesting the report on someone else, you don't need the full SSN) and pull the information from there. Finding a hospital near your address just requires knowing where hospitals are, and those are in public directories.