This rule may seem a bit confusing so let's break down what you really need to accomplish here. The short and simple is that you need to have a security plan which is documented and maintained according to HIPAA regulations (we will get to these so don't sweat it now). This document needs to contain areas which can address security incidents and how your organization will detect, prevent, and remediate security incidents.
There are multiple methods you can use to accomplish this, you can create a document titled security plan which contains all your security-related policies, or you can create several smaller policies, one for each specific area of HIPAA that requires documentation. Both options are valid and if executed properly will achieve compliance. Each option has its pros and cons, I'm not going to get into these in this article, but I will say I recommend smaller policies as they allow for a more granular approach with maintenance and distribution.