Good morning. Google’s project with the country’s second-largest health system to collect detailed health information on 50 million American patients sparked a federal inquiry and criticism from patients and lawmakers. The data on patients of St. Louis-based Ascension were until recently scattered across 40 data centers in more than a dozen states. Google and the Catholic nonprofit are moving that data into Google’s cloud-computing system—with potentially big changes on tap for doctors and patients.

At issue for regulators and lawmakers who expressed concern is whether Google and Ascension are adequately protecting patient data in the initiative, which is code-named “Project Nightingale” and is aimed at crunching data to produce better health care, among other goals. Ascension, without notifying patients or doctors, has begun sharing with Google personally identifiable information on millions of patients, such as names and dates of birth; lab tests; doctor diagnoses; medication and hospitalization history; and some billing claims and other clinical records.

[Continued below...]

The Office for Civil Rights in the Department of Health and Human Services “will seek to learn more information about this mass collection of individuals’ medical records to ensure that HIPAA protections were fully implemented,” the office’s director, Roger Severino, said. HIPAA refers to the federal Health Insurance Portability and Accountability Act of 1996, which generally allows hospitals to share data with business partners without telling patients as long as the information is used “only to help the covered entity carry out its health-care functions.” Privacy experts say Project Nightingale appears to be permissible under federal law.

A Google spokeswoman said in a statement: “We are happy to cooperate with any questions about the project. We believe Google’s work with Ascension adheres to industry-wide regulations (including HIPAA) regarding patient data, and comes with strict guidance on data privacy, security, and usage.” The spokeswoman said Ascension data wouldn’t be used to sell ads.

Digital disruption, shifting workplace norms and the rapidly changing state of world affairs have added new dimensions to corporate compliance. Join The Wall Street Journal in New York on Nov. 19 for a live discussion with chief compliance officers from leading companies about how their focus is changing. For details and to register, click here.

Altair Engineering Inc. may have violated U.S. economic sanctions and export control regulations, the company said in a regulatory filing.

The Troy, Mich.-based engineering software company said it discovered the possible violations in May and disclosed them to regulators, according to the company’s latest quarterly financial report, which was filed last week with the Securities and Exchange Commission.

Altair suspected an unaffiliated third-party consultant in Poland may have provided proprietary software to an individual subcontractor residing in Iran, according to a regulatory filing in May that disclosed the potential breaches. The commercial software involved was developed by a Greek subsidiary of Altair, according to the May filing.

• Overstock.com Inc. shares hit a seven-year low Tuesday after the online retailer disclosed that a government investigation has widened to focus on the stock plans of some of its executives. In conjunction with its third-quarter earnings report, Overstock said it received a subpoena on Oct. 7 from the SEC’s enforcement division related to a dividend unveiled in June. The agency also demanded information about the stock-trading, or 10b5-1, plans of certain officers and directors.
   
• The American Civil Liberties Union and a group of McDonald’s workers from Michigan sued the fast-food giant on Tuesday, accusing the company of not properly handling allegations of sexual harassment at one of its restaurants. In the lawsuit, which seeks class-action status, the ACLU and workers at a Mason, Mich., store allege that acts of harassment, such as groping and other physical assaults, by a supervisor at the franchisee-owned restaurant went ignored by management.
   
• The Trump administration has finalized plans to shift authority over the export of certain firearms and ammunition from the State Department to the Commerce Department, part of a nearly decadelong effort to boost compliance, strengthen enforcement and protect U.S. technology. Under the rule change, the State Department would maintain control over the export of firearms and related items of a military character, or that provide military or intelligence benefits to the U.S., according to a department official.
   
• The Internal Revenue Service is pursuing criminal cases surrounding land-conservation deals that have emerged as a focus of the agency’s enforcement efforts, the tax agency said on Tuesday. The involvement of IRS criminal investigators marks the latest expansion of the tax agency’s yearslong attempts to curb so-called syndicated conservation easements. The IRS didn’t disclose details about the number of potential criminal cases, but said its combined civil and criminal efforts include billions of dollars in deductions and thousands of investors in the deals.
   
• A group of lawmakers wants to limit interest rates on consumer loans nationally at 36%, a move that worries the payday and online-lending industries. The legislation introduced Tuesday in both chambers of Congress aims to extend to all consumers an interest-rate limit already in place for the military, its sponsors said. A rate cap of 36% would effectively eliminate traditional payday loans, which often charge interest rates exceeding 300%, as well as many installment loans offered online.

Tariffs are emerging as the main stumbling block in efforts by the U.S. and China to come to a limited trade deal, a month after the two countries called a truce in their trade war.

The logjam centers on whether the U.S. has agreed to remove existing tariffs in the so-called “phase one” deal that the two countries have been working toward—or whether the U.S. would only cancel tariffs set to take effect Dec. 15, according to people familiar with the talks.

Changes in technology and the structure of audit firms have prompted a U.S. regulator to consider tweaking rules governing the controls audit firms use to determine the quality of their audits.

The Public Company Accounting Oversight Board is weighing whether to change longstanding rules on audit firms’ quality-control systems as part of a broader overhaul of its inspection processes, according to the board.

The PCAOB, which regulates firms that audit public companies listed in the U.S., is expected to discuss a preliminary proposal at a meeting next month aimed at ensuring that audit firms are more proactive in identifying emerging risks and deficiencies in their quality-control systems. The public’s feedback on the so-called concept release would help the board form a proposal.

Nike said it would stop selling its clothes and sneakers directly to Amazon, an about-face for the sportswear brand.

The sneaker giant agreed in 2017 to sell products to Amazon in exchange for stricter policing of counterfeits and restrictions on unsanctioned sales. It was part of Amazon’s effort to court big fashion brands to sell their products through its website.

In a statement Tuesday, Nike said it has decided to focus on its direct business, though it will continue to seek partnerships with other retailers and platforms. Nike’s move was earlier reported by Bloomberg News.

For years, Nike had refused to sell directly to Amazon, fearing it would undermine its brand. Nike executives were unhappy with how unauthorized sellers continued to be widely available on Amazon, according to people familiar with the matter.

• Alleged Russian cybercriminal Alexei Burkov was extradited from Israel to the U.S. on hacking-related charges, including fraud, identity theft, computer intrusion and money laundering, after the Kremlin’s efforts to recover him in an unusual prisoner exchange failed. Prosecutors accused Mr. Burkov of managing a website where he offered to sell data from more than 150,000 illegally obtained credit cards, including tens of thousands belonging to people in the U.S. 
   
• Senate Minority Leader Chuck Schumer (D., N.Y.) is raising concerns about the U.S. Army’s use of video-sharing app TikTok and other China-owned social media platforms for recruiting efforts, citing the potential for personal data to be shared with the Chinese government. “National security experts have raised concerns about TikTok’s collection and handling of user data,” Mr. Schumer wrote in a Nov. 7 letter to Army Secretary Ryan McCarthy.

Boeing said it has lost orders for about 200 of its 737 MAX jets this year because of airline bankruptcies and customers swapping out for other models from the U.S. plane maker.

While Boeing said there have been no direct cancellations because of the global grounding of the jet in March, last month its MAX backlog was reduced by another 18 planes as two customers changed existing orders. The Chicago-based company currently has outstanding orders for 4,525 MAX jets.

Customers routinely swap aircraft orders, but the MAX backlog is under intense investor scrutiny following repeated delays in the plane’s return to service following two fatal crashes.

A former chief executive of aluminum giant United Co. Rusal PLC will become finance chief of Sberbank, Russia’s biggest lender.

The appointment of Alexandra Bouriko, who is expected to join Moscow-based Sberbank on Jan. 1, comes as Russian banks are experiencing heightened domestic demand for loans as U.S. sanctions force Western banks to sever ties with some Russian clients.

Ms. Bouriko, who will hold the title of senior vice president and head of finance, will be responsible for the bank’s finances as well as its treasury, accounting and reporting functions, tax planning department, investor relations and data management team, Sberbank said.

Subscribe to The Morning Risk Report here.

Follow us on Twitter at @WSJRisk, @kcbroughton, @_MengqiSun and @dgtokar.

Send comments to the Risk & Compliance editor, Jack Hagel, at jack.hagel@wsj.com.