I usually reach for HMAC when a bare hash is acceptable, just because often when attacks are found against a hash algorithm, those attacks don't apply to the HMAC construction with that same hash.  So the only benefit to using HMAC here over bare sha256 is for future proofing about theoretical breaks in sha256.