I presume this information is confidential and therefore in addition to hiding the links to the files you'll want to actually make them inaccessible completely to anyone on the web, even if they were to guess the URL, unless that user has explicit permission to download the files.

Look into storing the files on [Amazon S3](http://aws.amazon.com/s3/) securely and then providing [pre signed](http://aws.amazon.com/articles/Amazon-S3/5050) (time limited) URLs to the file provided the correct security checks have been satisfied (i.e. the user has logged into your site and is who they say they are).

There is a very good [AWS SDK](http://aws.amazon.com/sdkforphp/) that makes it very straight forward to do this.

What you'll need to research is how to send files uploaded through the WP upload interface into S3 instead, alternatively build your own [uploader](http://aws.amazon.com/articles/1434?_encoding=UTF8&fromSearch=1&queryArg=searchQuery&searchPath=articles&searchQuery=upload&x=0&y=0).

Another options would be too look into the code of [WP e-commerce](http://getshopped.org). They offer secure download of software files (e.g. MP3s). I believe the files are converted into hashes with an encryption key that is generated per user on purchase. This would take a some deciphering to see how it worked, but the process will not be unique to this plugin so other examples will be available (somewhere).