You can't change privacy settings for media you upload to WordPress. Once a user adds a file to the Media Library, any other user (regardless of role) can use that file. Media is also accessible to anyone in the world with the URL, and can be indexed by search engines.
We know that restricting media access is important to the UVA community. Our engineers are researching solutions.