I use hook_file_download_access:
/**
* Implement hook_file_download_access().
*/
function vw_application_file_download_accessYOURMODULENAME_file_download_access($file_item, $entity_type, $entity) {
global $user;
return (in_array('hr', $user->roles) || in_array('administrator', $user->roles)) ? TRUE : FALSE;
}