D7 - download files works for admin, not for other users
As you setup the content type default as unpublished, this will prevent any one to see the individual content but the author of the content(if he or she has permission to "View own unpublished content") and User with the privilege of "Bypass content access control"
which probably you don't want to give it to any one but admin, so basically there is a better approach to this : 

I recommend to  

1) setup content type default as published

2) Setup Content Access module http://drupal.org/project/content_access

3) Setup content type access permission by Content Access module.

3-1) Use Content access module to prevent any user but HR to have access to the specified content type. This will prevent any one to have access to following content type but HR, so you don't need to worry about content being published.

3-2) give permission to the specified rules (maybe anonymous or authenticated) to be able to create the specified content type.

Note: Don't do this in production environment, first test it to make sure everything is as you want it since "content access" module will rewrite your current website permissions. 

If it still seems confusing let me know I will add photos to explain it.