The story of the world’s youngest female and self-made billionaire, Elizabeth Holmes, shocked many. Inside and out of Silicon Valley. Such a compelling story that it was transformed into a book, a documentary, a podcast, and a film. The company, Theranos, was set to become the Apple of healthcare and similarly, change the world forever. At least that’s what Holmes hoped for—she certainly never hid her desire to be the next Steve Jobs. While that’s not unnatural in Silicon Valley, the steps Elizabeth took to get there definitely deviated from the ethical norms of entrepreneurship.

Having raised over $700m in investment from people such as Larry Ellison and Tim Draper, the company had become the rising star of Silicon Valley and had been valued at over $9 billion.

Holmes’ technology promised to run hundreds of tests from just a drop or two of blood. A promise she would later never fulfill. Holmes took investors’ money on the condition that she wouldn’t have to reveal how Theranos’ technology worked. A smart strategy at the time.

The only problem? The technology didn’t work.

Many patients were put at risk when their tests were incorrect. The worst? Theranos operated for almost 12 years until it was put under investigation. This was only initiated because the whistleblower, research engineer named Tyler Shultz, decided to take the risk and share his suspicion with The Wall Street Journal.

When things like this happen in the world we ask ourselves: How did this happen and why did it take so long for people to notice?

The fact that Elizabeth manipulated many employees, preventing them from coming forward, was part of the evidence in the Theranos case.

Many jurisdictions have introduced specific whistleblowing legislation to protect such individuals. In the UK, a single regime under the Public Interest Disclosure Act 1998 (PIDA) provides protection for whistleblowers in both the private and public sectors. Under the act, a worker is ensured the right to make a protected disclosure in cases of suspected misconduct or fraud, while in the US, there is not a simple answer to problems such as this. The level of protection in the US is also relative to the conditions in which fraud occurred.

In a susceptible world to tech fraud, the Whistleblowing Act could potentially have been more successful in preventing scenarios such as the Theranos from arising in the UK. The idea of not obstructing employees from reporting misconduct and introducing procedures for ensuring reliable reporting, should be mandatory. Unfortunately, that is not always the case, and definitely not everywhere in the world.

In practice, this difference could have meant that the employees of the Theranos would have come forward much sooner. People like Avie Tevanian, who led the software team of Steve Jobs prior to joining Theranos, and that resigned a year later, once he started seeing red flags.

PIDA also provides the assurance that a simple suspicion by an employee does not necessarily need to be correct. As long as the employee makes the statement honestly and in good faith.

The UK’s whistleblowing system is considered to be a well established set of laws despite receiving many critics for its inability to force companies into adopting internal whistleblowing procedures and policies. Even with the possibility that whistleblowing policies and procedures can be meaningless if they merely sit internally, it is more likely to see a commitment from companies when a framework exists. The fact that the Act can dictate an ethical path to companies and remind employees of the need to disclosure misconducts will set a tone in a start-up environment.

In times of a flood of emerging technologies promising to revolutionize different industries, it is mandatory that we have an adequate framework in place. As the Theranos scandal has shown us, the path to innovation can be a risky one if there are no boundaries being set. In this case, patients were clearly at risk when a failed technology was deployed in emergency rooms, hospitals and on the battlefield. The approach “fake it until you make it” does not work in healthcare and it certainly should be avoided in the technology space if it means putting lives at risk.

That being said, not everything that is legal is ethical. While it is widely expected that most entrepreneurs will act ethically, if the above scenario is applied to the everlasting questions involving technological innovation and ethics, then there is no more adequate response than to set appropriate legal boundaries.