The IBM Health Reimbursement Arrangement (HRA) is an employee [retiree] welfare benefit plan [health plan] and, as such, the Employee Retirement Income Security Act – ERISA applies.

Below are applicable sections of ERISA, from the DOL website, with highlights added.

Employee Retirement Income Security Act — ERISA

The Employee Retirement Income Security Act of 1974 (ERISA) is a federal law that sets minimum standards for most voluntarily established pension and health plans in private industry to provide protection for individuals in these plans.
ERISA requires plans to provide participants with including important information about plan features and funding; provides for those who manage and control plan assets; requires plans to establish a grievance and appeals process for participants to get benefits from their plans; and gives participants the right to sue for benefits and breaches of fiduciary duty.
There have been a number of amendments to ERISA, expanding the protections available to health benefit plan participants and beneficiaries. One important amendment, the , provides some workers and their families with the right to continue their health coverage for a limited time after certain events, such as the loss of a job. Another amendment to ERISA is the which provides important new protections for working Americans and their families who have preexisting medical conditions or might otherwise suffer discrimination in health coverage based on factors that relate to an individual's health. Other important amendments include the Newborns' and Mothers' Health Protection Act, the Mental Health Parity Act, and the Women's Health and Cancer Rights Act.
In general, ERISA does not cover group health plans established or maintained by governmental entities, churches for their employees, or plans which are maintained solely to comply with applicable workers compensation, unemployment, or disability laws. ERISA also does not cover plans maintained outside the United States primarily for the benefit of nonresident aliens or unfunded excess benefit plans.
?

Plan Information

The Employee Retirement Income Security Act (ERISA) requires plan administrators — the people who run plans — to give plan participants in writing the most important facts they need to know about their retirement and health benefit plans including plan rules, financial information, and documents on the operation and management of the plan. Some of these facts must be provided to participants regularly and automatically by the plan administrator. Others are available upon request, free-of-charge or for copying fees. The request should be made in writing.
One of the most important documents participants are entitled to receive automatically when becoming a participant of an ERISA-covered retirement or health benefit plan or a beneficiary receiving benefits under such a plan, is a summary of the plan, called the summary plan description or SPD. The plan administrator is legally obligated to provide to participants, free of charge, the SPD. The summary plan description is an important document that tells participants what the plan provides and how it operates. It provides information on when an employee can begin to participate in the plan, how service and benefits are calculated, when benefits becomes vested, when and in what form benefits are paid, and how to file a claim for benefits. If a plan is changed, participants must be informed, either through a revised summary plan description, or in a separate document, called a summary of material modifications, which also must be given to participants free of charge.
In addition to the summary plan description, the plan administrator must automatically give participants each year a copy of the plan's summary annual report. This is a summary of the annual financial report that most plans must file with the Department of Labor. These reports are filed on government forms called the Form 5500. The summary annual report is available at no cost. To learn more about the plan assets, participants may ask the plan administrator for a copy of the annual report in its entirety.
If participants are unable to get the summary plan description, the summary annual report or the annual report from the plan administrator, they may be able to obtain a copy by writing to the U.S. Department of Labor, EBSA, Public Disclosure Room, Room N-1513, 200 Constitution Avenue, N.W., Washington, D.C. 20210, for a nominal copying charge. Participants should provide their name, address and phone number to enable EBSA to contact them to follow up on the request.

Fiduciary Responsibilities

The protects your plan's assets by requiring that those persons or entities who exercise discretionary control or authority over plan management or plan assets, have discretionary authority or responsibility for the administration of a plan, or provide investment advice to a plan for compensation or have any authority or responsibility to do so are subject to fiduciary responsibilities. Plan fiduciaries include, for example, plan trustees, plan administrators, and members of a plan's investment committee.
The primary responsibility of fiduciaries is to run the plan solely in the interest of participants and beneficiaries and for the exclusive purpose of providing benefits and paying plan expenses. Fiduciaries must act prudently and must diversify the plan's investments in order to minimize the risk of large losses. In addition, they must follow the terms of plan documents to the extent that the plan terms are consistent with ERISA. They also must avoid conflicts of interest. In other words, they may not engage in transactions on behalf of the plan that benefit parties related to the plan, such as other fiduciaries, services providers, or the plan sponsor.
Fiduciaries who do not follow these principles of conduct may be personally liable to restore any losses to the plan, or to restore any profits made through improper use of plan assets. Courts may take whatever action is appropriate against fiduciaries who breach their duties under ERISA including their removal.