Does HIPAA require an authorization form to release information to a spouse or other family member?

Maybe. HIPAA incorporates state law for purposes of determining whether an individual is a "personal representative". A company should establish procedures that recognize the law in each state in which it has employees.

EOBs may be sent to the employee-participant. However, it is unlikely (for example) that a detailed discussion of claims history regarding an adult child can be disclosed to a parent without authorization.